Assistant Manager – Application Security Architect (Emiratization)

Role overview

Security architecture and delivery

• Develop security architecture standards, reference architectures, security patterns, and secure design principles for applications, infrastructure, cloud services, APIs, and digital platforms.
• Review technology designs and project initiatives for security standards, regulatory requirements, cyber controls, and industry practices.
• Conduct threat modelling, architecture risk assessments, and design reviews; identify risks and recommend mitigations.
• Define SSDLC security requirements, secure coding standards, and checkpoints; integrate controls, automated testing, and monitoring into DevSecOps and CI/CD pipelines.
• Assess web and mobile applications, APIs, and digital platforms for authentication, authorization, encryption, session management, and data protection.
• Conduct or coordinate penetration testing, vulnerability assessments, and validation for applications, APIs, authentication platforms, and cloud environments.
• Assess cloud-native applications, microservices, and containerized environments for appropriate security architecture and configuration controls.

Governance, assurance, and team leadership

• Implement controls and support cybersecurity regulations, information assurance standards, industry frameworks, governance, and assurance activities.
• Facilitate internal and external audits, security reviews, and regulatory assessments; provide evidence, support remediation, and monitor closure of findings.
• Support application-security incidents and digital-channel compromise investigations through technical analysis, root-cause identification, and corrective actions.
• Manage and supervise team activities, objectives, policies, service standards, and change initiatives in line with bank procedures.

Experience and education

• At least five years in cybersecurity, information security, technology risk, security architecture, application security, or infrastructure security, including architecture reviews, threat modelling, vulnerability assessments, and governance.
• Banking, financial services, or regulated-industry experience is preferred.
• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline.

Technical knowledge and credentials

• One or more recognized cybersecurity certifications, for example CISSP, CSSLP, OSCP, CEH, CCSK, SABSA, cloud security certifications, or equivalent.
• Relevant knowledge includes application and cloud security architecture, SSDLC, DevSecOps, secure coding, web, mobile and API security, penetration testing, vulnerability management, zero trust, identity and access management, cryptography, and container security.
• Framework knowledge includes OWASP Top 10, OWASP Mobile Top 10, OWASP API Security Top 10, and MITRE ATT&CK.
• Stakeholder management, analytical thinking, communication, and reporting skills.