Information Security Program Manager
Role Overview
--------------------
Key Skills for This Role
Full Job Posting
Information security program
- Plan and lead the end-to-end ISO/IEC 27001 program, including ISMS scope, timelines, budget, resources, and stakeholder reporting.
- Review security policies, standards, procedures, and records against ISO/IEC 27001:2022 and ISO/IEC 27002.
- Assess how security controls operate across people, processes, and technology; perform a gap analysis against Clauses 4–10 and Annex A.
- Develop a prioritized remediation roadmap and maintain the security risk methodology, risk register, and treatment plans.
- Assess risks across applications, infrastructure, networks, cloud services, and medical and clinical systems.
- Coordinate vulnerability assessments, penetration tests, and configuration reviews; track risk-rated findings through remediation and verification.
CIS compliance, audits, and reporting
- Establish a CIS-based compliance program using CIS Critical Security Controls v8 and CIS Benchmarks as configuration baselines.
- Conduct CIS compliance scans using tools such as CIS-CAT Pro, Tenable, or Qualys; track scores and coordinate remediation or documented exceptions.
- Maintain the Statement of Applicability and ISMS scope, policies, objectives, procedures, and supporting records.
- Assess supplier security risks and ensure security requirements are included in contracts.
- Run ISMS internal audits and management reviews, and track corrective actions through closure.
- Prepare for Stage 1, Stage 2, and surveillance audits; coordinate with the certification body and lead responses to findings.
- Report monthly and quarterly metrics on risk, controls, vulnerabilities, remediation, CIS scores, incidents, audits, and awareness completion.
- Deliver security awareness and training, and align the ISMS with company policies and applicable UAE and Dubai requirements, including UAE Information Assurance Standards, DESC, and healthcare data regulations.
Related management systems
- Support ISO/IEC 20000-1 IT Service Management and ISO 22301 Business Continuity Management implementation, maintenance, and certification.
- Align ISMS controls with ITSM incident, problem, change, configuration, capacity, availability, and supplier processes.
- Contribute to business impact analysis, recovery objectives, and continuity risk assessments for critical services and information assets.
- Support development and testing of service continuity, disaster recovery, and business continuity plans; capture and act on lessons learned.
- Identify opportunities to integrate management-system policies, documentation, audits, and reviews, and support related external and internal audits.
Qualifications and experience
- Bachelor's degree in Information Security, Information Technology, Computer Science, or a related field.
- 7–10+ years of information security experience, including at least 3 years leading ISMS, security risk, or compliance programs.
- A proven track record of leading at least one ISO/IEC 27001 implementation or certification.
- The supplied description ends mid-qualification after the words 'In-depth knowledg'; further qualifications cannot be verified.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career
More from this employer
More jobs at VaporVM
Cybersecurity Technical Validation Engineer (Saudi National)
, KSA
VaporVM seeks a Cybersecurity Technical Validation Engineer to conduct hands-on security testing, adversarial simulations, and technical validation across web, mobile, kiosk, cloud, infrastructure, and network environmen
Global Access Management (GAM) Engineer
, UAE
The employer seeks an experienced Global Access Management Engineer to lead implementation and operations for IAM/IGA solutions, governance, and identity lifecycle workflows. Candidates need 7–10 years of relevant experi
Microsoft Services Sales Manager II
Riyadh, KSA
VaporVM is hiring a Microsoft Services Sales Manager II in Riyadh to drive sales of Microsoft-based cloud, productivity, and security solutions. The role covers new business development, pipeline management, deal closing
Post-Quantum Cryptography (PQC) Engineer
, KSA
VaporVM is seeking a Post-Quantum Cryptography Engineer to design, implement, and integrate quantum-resistant cryptographic solutions and prepare enterprise systems for quantum threats. The role covers NIST PQC algorithm
Security Architect (SABSA Certified)
, QAT
VaporVM seeks an experienced Security Architect to design enterprise security architectures aligned with business objectives, risk, and regulation. The role requires mandatory SABSA certification, security architecture e
Lead Corporate Governance Consultant
, UAE
The employer is seeking a lead consultant to direct corporate governance initiatives for a UAE government entity. The work covers governance frameworks, board and committee oversight, compliance, risk assessments, and im
Security Systems Engineer
, KSA
VaporVM is seeking an experienced Cybersecurity Engineer to manage, operate and maintain enterprise security systems including PAM, IAM, firewalls/NGFW, SIEM and IDS/IPS. The role covers security monitoring, incident inv
Lead Data Governance & Management Consultant
, UAE
The employer is seeking a lead consultant to deliver data governance, maturity assessment, and open data initiatives for UAE government entities. The role requires 8–15 years of experience, including 5–8 years in the UAE
Cybersecurity Technical Validation Engineer (Saudi National)
, KSA
Global Access Management (GAM) Engineer
, UAE
Microsoft Services Sales Manager II
Riyadh, KSA
Post-Quantum Cryptography (PQC) Engineer
, KSA
Security Architect (SABSA Certified)
, QAT
Lead Corporate Governance Consultant
, UAE
Security Systems Engineer
, KSA
Lead Data Governance & Management Consultant
, UAE