Lead Cyber Security Engineer

Position Overview

Dubai Insurance Co. is searching for a highly skilled and proactive technical security lead with extensive hands-on experience to develop, operate, and evaluate security controls within our organization. This role is split approximately 70% on technical activities and 30% on compliance-related tasks, specifically for a CBUAE-regulated insurer.

Key Responsibilities

• Oversee the security operations as the primary technical contact for our outsourced Security Operations Center (SOC) managed service provider (MSSP). Tasks include challenging triage decisions, creating new threat detection mechanisms—particularly for insurance-specific threats like claims fraud and health data exfiltration—conducting purple-team exercises, and managing major security incidents.
• Manage core security controls hands-on, such as Data Loss Prevention (DLP) tools (Purview/Forcepoint), endpoint management via Intune/MDM, patch management, and vulnerability management processes prioritized by CVSS, EPSS, and CISA KEV standards.
• Secure business-critical systems including policy, claims, underwriting platforms, ERP, portals, mobile applications, and APIs by defining security requirements for vendors and authorizing security clearance prior to deployment.
• Lead Vulnerability Assessment and Penetration Testing (VAPT) activities by defining scope, commissioning tests, reproducing findings, and ensuring remediation with evidential closure.
• Implement hardening procedures across endpoints, infrastructure, and networks, covering EDR/XDR solutions, cloud platforms (Azure, AWS, M365), Entra ID, Privileged Access Management (PAM), zero trust architecture, firewalls, and Web Application Firewalls (WAF).
• Head Governance, Risk, and Compliance (GRC) efforts including maintaining a singular audit gap tracker, a consolidated control framework aligned with ISO 27001, ADHICS, UAE IA, CBUAE, and PDPL standards. Produce monthly security metrics and quarterly cyber risk reports for the Board.

Candidate Requirements

• 8 to 12 years of direct, hands-on experience in cybersecurity engineering or operations.
• Proven expertise in supervising outsourced SOC operations, leading incident response activities, managing VAPT and vulnerability programmes, and driving audit closure.
• Experience with ISO 27001 implementation or audits.
• Practical knowledge of UAE regulatory environments including CBUAE, UAE IA, DoH/ADHICS, or DHA.
• Possession of at least one technical certification such as OSCP, GCIH, GCIA, GCFA, GPEN, AZ-500 or a comparable firewall or EDR vendor certification (Certifications like CISSP, CISM, CISA are advantageous but do not replace the need for a hands-on cert).
• Proficiency in scripting with PowerShell or Python for automation tasks.
• Bachelor's degree in Computer Science, Information Security, Engineering, or a related discipline.

Preferred Qualifications

• Experience within insurance, takaful, brokerage, or third-party administrator sectors, especially relating to health insurance.
• Background in banking sectors regulated by CBUAE.
• Familiarity with DESC ISR, SAMA CSF, or NCA ECC cybersecurity frameworks.