Senior Consultant – Information Security

About the Role

The Senior Consultant will lead efforts in information security governance, manage the Information Security Management System (ISMS), oversee risk and compliance processes and coordinate audit and security advisory activities throughout the organization. They act as the key point of contact ensuring alignment with standards such as ISO 27001 and regulatory mandates including UAE PDPL and Dubai ISR. Collaboration with various internal departments and leadership ensures effective identification, evaluation, and management of security risks.

Key Responsibilities

• Oversee continual enhancement and management of the ISMS.
• Develop and maintain security policies, procedures, guidelines, and standards.
• Lead ISO 27001 certification processes and surveillance reviews.
• Coordinate ISMS management reviews and related reporting activities.
• Track security objectives, KPIs, and corrective measures to foster improvement.
• Ensure organizational and regulatory compliance is met.
• Perform comprehensive information security risk assessments on projects, systems, vendors, and business processes.
• Guide risk remediation planning with designated risk owners and escalate delayed actions.
• Support broader enterprise risk management initiatives focused on cyber and technology risks.
• Conduct third-party security evaluations and due diligence assessments.
• Review and advise on security clauses within vendor contracts (MSA, SOW, DPA etc.) collaborating with procurement and legal teams.
• Assess security risks related to SaaS, cloud, managed services, and technology vendors, recommending feasible mitigation strategies.
• Maintain third-party risk documentation and oversee remediation efforts.
• Engage in project governance by attending reviews and steering committees to ensure security concerns are addressed throughout lifecycles.
• Coordinate and act as primary contact for internal and external audits, including ISO 27001 audits.
• Maintain documentation repositories, track audit observations, and oversee follow-up remediation plans.
• Generate compliance reports for management review.
• Participate in security incident governance, supporting investigations, root cause analyses, and lessons learned.
• Evaluate policy breaches and control weaknesses and suggest corrective and preventive measures.

Qualifications and Experience

• Bachelor’s or Master’s degree in Information Security, Computer Science, Information Systems, or related field.
• Over 10 years of professional experience with at least 6 years focusing on Information Security Governance, Risk Management, and Compliance (GRC).
• Direct experience implementing and managing ISO 27001 standards.
• Proven background conducting third-party security assessments and vendor contract reviews.
• Experience coordinating audit activities and certification processes.
• Strong capability in stakeholder management, particularly with business and executive leadership.

Preferred Certifications

• CISSP, CISM, or CISA certifications preferred.
• CRISC certification advantageous.
• ISO 27001 Lead Implementer or Lead Auditor certifications desirable.
• CDPSE and ISO 22301 Lead Auditor or Implementer certifications beneficial.