IT Security - Risk Management

Role purpose

Location and engagement

• The description lists the role location as Dubai, United Arab Emirates.
• Employment type is stated as a one-year extension.

Governance, risk and compliance

• Maintain governance practices aligned with UAE regulatory requirements, DESC ISR, sector requirements, ISO 27001, NIST, and organizational policies.
• Assess and track risks, control gaps, remediation, owners, closure dates, risk treatments, exceptions, formal acceptances, and compensating controls.
• Maintain GRC risk registers and evidence; monitor remediation and escalate overdue, high, and critical risks.

Technical reviews and project assurance

• Review solution architectures, designs, implementation plans, technology proposals, configurations, and controls before deployment.
• Assess security across infrastructure, networks, operating systems, databases, applications, APIs, cloud, IAM, encryption, monitoring, vulnerability management, and data protection.
• Evaluate assessment and penetration testing findings, remediation plans, residual risk, cloud and SaaS solutions, integrations, data flows, hosting, and data residency.
• Advise projects, assess solutions against approved architecture and requirements, recommend remediation, and verify go-live risks are mitigated or formally accepted.
• Evaluate security technologies and collaborate with infrastructure, network, cloud, application, operations, and managed service teams.

Policies, controls, audits and third parties

• Develop and maintain cybersecurity policies, standards, procedures, and SOPs; translate framework requirements into practical controls.
• Assess control design, implementation, and operating effectiveness; improve control maturity and address recurring findings.
• Coordinate internal, external, regulatory, and certification audits, evidence, control validation, audit responses, corrective actions, and closure.
• Assess third-party and managed service provider risks, including access, remote support, subcontracting, data handling, hosting, and compliance.

Experience and technical qualifications

• At least 10 years of information security or cybersecurity experience, with substantial GRC, technical assessment, risk management, and regulatory compliance work.
• Hands-on technical security review and risk assessment experience across applications, infrastructure, networks, cloud, and enterprise technology.
• Strong knowledge of security architecture, network, operating system, database, application and API security, IAM, encryption, vulnerability management, and monitoring.
• Knowledge of ISO 27001, NIST Cybersecurity Framework, risk methodologies, and UAE requirements including DESC ISR.
• Experience with risk registers, audit management, policy governance, third-party assessments, and RSA Archer or an equivalent GRC platform.
• Experience working with IT operations, infrastructure, cloud, network, application, cybersecurity, and managed service teams in large or regulated environments.

Communication and preferred certifications

• Strong analytical, report-writing, stakeholder management, and presentation skills; able to explain technical risks and business implications to senior management.
• Preferred certifications include CISSP, CISM, CRISC, CISA, ISO/IEC 27001 Lead Implementer or Lead Auditor, and relevant cloud, application security, penetration testing, or risk certifications.
• The role calls for independent judgment, risk-based recommendations, and balancing security, regulation, operational constraints, and business objectives.