About the role

Position: IT Security- Risk Management

Duration: 1 yr ext.

Salary : Max 22000AED (+single benefits)

Location: DUBAI-Onsite

Notice: immediate to max 1 month

Candidate location: UAE base (priority) outside UAE (Immediate joiners ONLY)

Nationality: (excluding Pakistanis & Egyptians)

Kindly send CVs on or before Oct 22; Thus 9AM

IT Security- Risk Management

22000AED

Position	Name of the candidate	Notice period	Location	Contact Numbers	Email ID	Nationality	Current Salary	Expected Salary	Agency	MOFA Attested Degree (Y/N)

Job Description

IT Security - Risk Management

Job Information

Job Title	IT Security- Risk Management
Reports To	Head of Section
Job Grade	[Grade]
Location	Dubai, United Arab Emirates
Employment Type	[Full-time / Fixed-term contract – X months]
Job Code	[Code]

Job Purpose

The Senior Cybersecurity Risk & Compliance Consultant will lead cybersecurity governance, risk management, regulatory compliance, and audit readiness while providing technical security oversight across IT projects, applications, infrastructure, cloud environments, networks, and third-party solutions.

The role requires a strong blend of cybersecurity GRC expertise and technical security knowledge to conduct security architecture reviews, technical risk assessments, control effectiveness evaluations, and compliance reviews. The consultant will work closely with IT, Cybersecurity, Managed Services, business stakeholders, vendors, auditors, and external consultants to ensure that technology initiatives meet organizational security requirements and applicable regulatory obligations.

Key Responsibilities

Cybersecurity Governance, Risk & Compliance

Implement and maintain cybersecurity governance practices aligned with applicable UAE regulatory requirements, including DESC Information Security Regulation (ISR), relevant sector-specific requirements, ISO 27001, NIST, and organizational security policies.
Conduct cybersecurity risk assessments for applications, infrastructure, networks, cloud services, technology projects, vendors, and significant IT changes.
Identify, evaluate, document, and track inherent and residual risks, control gaps, remediation actions, risk owners, and target closure dates.
Develop risk treatment plans and manage security exceptions, formal risk acceptances, compensating controls, and periodic reviews of accepted risks.
Maintain risk registers and supporting evidence within the enterprise GRC platform, such as RSA Archer or an equivalent solution.
Monitor remediation progress and escalate overdue, high, and critical risks to management and relevant governance committees.

Technical Security Reviews & Risk Assessments

Conduct technical security reviews of solution architectures, high-level and low-level designs, implementation plans, and technology proposals before deployment.
Assess security risks associated with on-premises infrastructure, networks, operating systems, databases, web applications, APIs, cloud platforms, identity and access management, and security technologies.
Review technical configurations, access controls, authentication mechanisms, encryption, network segmentation, logging and monitoring, vulnerability management, endpoint protection, and data protection controls.
Evaluate technical security assessment reports, vulnerability assessment and penetration testing findings, and remediation plans; validate the adequacy of proposed corrective actions and residual risk.
Review cloud and SaaS solutions, system integrations, third-party connectivity, data flows, hosting arrangements, and data residency requirements against applicable security and regulatory obligations.
Assess security requirements for technology procurement, software and hardware acquisitions, infrastructure changes, and new implementations.
Identify security design weaknesses, misconfigurations, control deficiencies, and compliance gaps, and recommend practical remediation measures and compensating controls.
Verify that security requirements are addressed before go-live and ensure that unresolved risks are appropriately mitigated or formally accepted by authorized stakeholders.

Security Architecture & Project Assurance

Act as a cybersecurity advisor to IT and business projects, ensuring that security requirements are incorporated from the design and planning stages.
Review proposed solutions against approved security architecture, technology standards, cybersecurity policies, and regulatory requirements.
Evaluate the effectiveness and suitability of security controls and technologies, including firewalls, web application firewalls, endpoint detection and response, data loss prevention, privileged access management, identity governance, security monitoring, and encryption.
Collaborate with infrastructure, network, cloud, application, operations, and managed service teams to address security gaps and improve control implementation.
Provide documented security review findings, recommendations, conditions for approval, and risk-based implementation guidance.

Policy, Standards & Control Management

Develop, review, and maintain cybersecurity policies, standards, procedures, and standard operating procedures (SOPs).
Translate regulatory and framework requirements into implementable technical and operational security controls.
Conduct periodic control assessments to evaluate control design, implementation, and operating effectiveness.
Identify opportunities to strengthen cybersecurity processes, improve control maturity, and address recurring audit and risk findings.

Audit, Compliance & Third-Party Risk Management

Coordinate and support internal, external, regulatory, and certification audits, including evidence collection, control validation, and responses to audit queries.
Perform compliance gap assessments against applicable regulatory frameworks, ISO 27001, NIST, and organizational security requirements.
Develop corrective and preventive action plans, track audit observations to closure, and validate supporting evidence.
Assess third-party and managed service provider security risks, including access management, remote support, subcontracting, data handling, hosting, and compliance obligations.
Maintain audit and compliance documentation and support continuous improvement of the organization's cybersecurity governance and risk maturity.

Qualifications and Experience

Minimum 10 years of experience in information security or cybersecurity, with substantial experience in GRC, technical security assessments, risk management, and regulatory compliance.

Demonstrable hands-on experience conducting technical security reviews and risk assessments across applications, infrastructure, networks, cloud environments, and enterprise technology solutions.

Strong understanding of security architecture, network security, operating system and database security, application security, APIs, identity and access management, encryption, vulnerability management, and security monitoring.

Proven experience identifying technical vulnerabilities, evaluating security controls, assessing remediation plans, and determining residual risk.

Strong knowledge of ISO 27001, NIST Cybersecurity Framework, risk management methodologies, and applicable UAE cybersecurity requirements, including DESC ISR.

Experience with risk registers, audit management, policy governance, third-party risk assessments, and enterprise GRC platforms such as RSA Archer or equivalent.

Experience working with IT operations, infrastructure, cloud, network, application, cybersecurity, and managed service teams in large or regulated environments.

Strong analytical, report-writing, stakeholder management, and presentation skills, with the ability to communicate technical risks and business implications to senior management.

Preferred Certifications

CISSP – Certified Information Systems Security Professional
CISM – Certified Information Security Manager
CRISC – Certified in Risk and Information Systems Control
CISA – Certified Information Systems Auditor
ISO/IEC 27001 Lead Implementer or Lead Auditor
Relevant certifications in cloud security, application security, penetration testing, or cybersecurity risk management.

Key Competencies

Strong technical security assessment and risk analysis capabilities.
Ability to balance technical security requirements, regulatory compliance, operational constraints, and business objectives.
Independent judgment in identifying security gaps and recommending risk-based remediation.
Effective stakeholder engagement, governance reporting, and coordination across technical and business teams.