Security Engineer - GRC/ISMS

Role Overview

This position involves managing governance, risk, and compliance (GRC) aspects focusing on the Information Security Management System (ISMS) within an organization based in Dubai, UAE. The role entails overseeing ISO 27001 compliance, risk assessment, vendor security management, audit coordination, incident governance, and promoting security awareness.

Key Responsibilities

• Oversee and enhance the ISMS continuously, including maintaining all information security policies, standards, procedures, and guidelines.
• Coordinate ISO 27001 certification and ongoing surveillance processes to ensure compliance.
• Facilitate management reviews and provide comprehensive reporting for ISMS performance.
• Track security objectives, key performance indicators, address corrective measures, and promote continual improvements.
• Ensure adherence to regulatory mandates and organizational security requirements.
• Conduct comprehensive information security risk assessments for projects, systems, vendors, and business workflows.
• Lead risk treatment planning with designated risk owners and monitor progress, escalating overdue tasks.
• Contribute to enterprise-wide cyber and technology risk management initiatives.
• Perform thorough security evaluations of third-party vendors and technologies including SaaS and cloud services, reviewing contractual security provisions and working collaboratively with Procurement and Legal teams during contract negotiations.
• Maintain risk registers and oversee remediation actions related to third-party security risks.
• Participate actively in project oversight, ensuring security requirements are incorporated through each project phase.
• Lead coordination of internal and external audits, serving as the main contact for ISO 27001 assessments, managing evidence, tracking issues, and providing compliance updates to senior management.
• Engage in the governance of security incidents by supporting investigations, root cause analyses, assessing policy breaches, and proposing corrective and preventive strategies.
• Support the organization's security awareness campaigns, evaluate their effectiveness using relevant metrics, and foster a culture attentive to security considerations.

Required Qualifications and Experience

• Bachelor's or Master's degree in Information Security, Computer Science, Information Systems, or an allied field.
• At least 15 years of total experience, including a minimum of 10 years specifically in Information Security Governance, Risk, and Compliance.
• Practical experience in implementation and upkeep of ISO 27001 standards.
• Experience conducting security assessments for third-party vendors.
• Proven capability in reviewing technology contracts focusing on security clauses.
• Prior involvement in coordinating audits and certification processes.
• Proficient in collaborating with business units and executive leadership.

Preferred Professional Certifications

• CISSP, CISM, CISA
• CRISC
• ISO 27001 Lead Implementer or Lead Auditor
• CDPSE
• ISO 22301 Lead Auditor or Implementer

Behavioral Skills

• Excellent stakeholder engagement and management capabilities.
• Strong analytical and critical thinking skills.
• Proficient negotiation and report-writing abilities.
• Decision-making grounded in risk assessment.
• Effective communication skills tailored for executive audiences.
• Problem-solving orientation.