IT Security - Risk Management

Role overview

Qualifications and experience

• Requires at least 10 years in information security or cybersecurity, including substantial GRC, technical security assessment, risk management, and regulatory compliance experience.
• Requires hands-on reviews and risk assessments spanning applications, infrastructure, networks, cloud, and enterprise technology.
• Requires broad knowledge of security architecture, network, operating system, database, and application security; APIs; identity and access management; encryption; vulnerabilities; and monitoring.
• Requires experience identifying vulnerabilities, evaluating controls, reviewing remediation plans, and determining residual risk.
• Requires knowledge of ISO 27001, NIST Cybersecurity Framework, risk management methods, and UAE requirements including DESC ISR.
• Requires experience with risk registers, audit management, policy governance, third-party risk assessments, and GRC platforms such as RSA Archer or equivalent.
• Requires collaboration with IT operations, infrastructure, cloud, network, application, cybersecurity, and managed service teams in large or regulated environments.
• Requires analytical, report-writing, stakeholder management, and presentation skills to communicate risks and business implications to senior management.

Preferred certifications

• Preferred certifications include CISSP, CISM, CRISC, CISA, and ISO/IEC 27001 Lead Implementer or Lead Auditor.
• Relevant certifications in cloud security, application security, penetration testing, or cybersecurity risk management are also preferred.

Contract duration

• One-year contract with possible extension; no compensation amount or pay cadence is stated.

Responsibilities

• Conduct technical security reviews and risk assessments across applications, infrastructure, networks, cloud environments, and enterprise technology.
• Identify vulnerabilities, evaluate security controls, assess remediation plans, and determine residual risk.
• Support cybersecurity governance, regulatory compliance, and risk management activities.
• Manage risk registers, audit activities, policy governance, and third-party risk assessments.
• Work with IT operations, infrastructure, cloud, network, application, cybersecurity, and managed service teams.
• Communicate technical risks and business implications to stakeholders and senior management through reports and presentations.