Sr Security Analyst

Role summary

Program responsibilities

• Manage gap assessment, scope definition, risk assessment, and risk treatment.
• Lead ISO/IEC 27001 implementation, including the Statement of Applicability and policies.
• Manage evidence, internal audits, corrective actions, management reviews, and certification readiness.
• Maintain risk registers, compliance plans, audit evidence, corrective-action tracking, and executive reporting.
• Present to executives, audit committees, regulators, external auditors, and bank stakeholders.
• Coach junior analysts and coordinate control owners across distributed teams.

Technical skills

• Knowledge of banking security, data protection, third-party risk, business continuity, incident management, and regulatory compliance.
• Working understanding of SIEM/SOC, IAM/MFA/PAM, network and endpoint security, vulnerability management, cloud security, DLP, encryption, backup/DR, and secure SDLC.
• PCI DSS, ISO 22301, NIST CSF, CIS Controls, SWIFT CSP, or comparable banking frameworks are relevant.
• Exposure to Microsoft Sentinel/Defender, Azure/AWS security, GRC platforms, vulnerability scanners, and audit/evidence automation is preferred.

Education and certifications

• Bachelor’s degree in cyber security, Information Security, Computer Science, IT, or a related discipline.
• Valid ISO/IEC 27001 Lead Auditor certification from a recognized training or certification body.
• At least one of CISA, CISSP, CISM, or CRISC is listed; ISO 27001 Lead Implementer, ISO 22301, or PCI DSS are also listed.
• A master’s degree in cyber security, Information Security, or Risk Management is preferred.

Experience and communication

• 5–8 years in information security, including at least 3 years in security governance, risk, compliance, or audit within banking or financial services.
• Experience managing ISO 27001 implementation, internal audit, remediation, and external certification or surveillance audit.
• Experience with PCI DSS, central-bank requirements, privacy compliance, third-party assessments, BIA/BCP/DR, incident exercises, or regulatory reporting.
• Practical involvement in SOC, vulnerability management, penetration testing, IAM, cloud security, or architecture reviews.
• Professional English proficiency is required for reports, policies, and executive presentations; Arabic is an advantage.

Working approach