Security Engineer - GRC/ISMS بدوام كامل في دبي
التخصص
الأمن والسلامة
نوع الدوام
دوام كامل
الخبرة
أي مستوى
الموقع
دبي
وصف الوظيفة
Role: Security Engineer - GRC/ISMS Locations: Dubai, UAEJob Type - FTEKey Responsibilities:Information Security Governance & ISMSManage and continuously improve the Information Security Management System (ISMS).Maintain information security policies, standards, procedures, and guidelines.Coordinate ISO 27001 certification and surveillance activities.Facilitate ISMS Management Reviews and reporting.Monitor security objectives, KPIs, corrective actions, and improvement initiatives.Ensure compliance with regulatory and organizational requirements.Risk ManagementConduct information security risk assessments across projects, systems, vendors, and business processes.Facilitate risk treatment planning with risk owners.Monitor risk mitigation progress and escalate overdue actions.Support enterprise risk management activities related to cyber and technology risks.Third-Party & Vendor Security Risk ManagementPerform vendor security assessments and due diligence reviews.Review security clauses in the vendor contractual documentation (MSA, SOW, DPA etc.)Work closely with Procurement and Legal teams during contract reviews.Evaluate SaaS, cloud, managed service providers, and technology vendors for information security and data privacy.Identify security, privacy, confidentiality, and compliance risks.Recommend practical risk treatment options.Maintain third-party risk registers and remediation actions.Project Security AdvisoryParticipate in project reviews and steering committees.Ensure security requirements are addressed throughout project lifecycles.Audit & ComplianceCoordinate internal and external audits.Act as primary liaison for ISO 27001 audits.Maintain evidence repositories.Track audit findings and remediation plans.Provide compliance reporting to management.Security Incident GovernanceParticipate in governance reviews of information security incidents.Support investigations, root cause analysis, and lessons learned activities.Assess policy violations and control failures.Recommend corrective and preventive actions.Security AwarenessSupport and coordinate security awareness initiatives.Measure awareness effectiveness through metrics and reporting.Promote a security-conscious culture across the organization.Required Qualifications:EducationBachelor's or Master's degree in Information Security, Computer Science, Information Systems, or related discipline.Experience15+ years of overall experience with minimum 10+ years dedicated to Information Security GRC.Hands-on experience implementing and maintaining ISO 27001.Experience conducting third-party security assessments.Experience reviewing technology contracts and security clauses.Experience supporting audits and certification activities.Experience engaging with business and executive stakeholders.Preferred CertificationsCISSP/CISM/CISACRISCISO 27001 Lead Implementer/ Lead AuditorCDPSEISO 22301 Lead Auditor / ImplementerBehavioral CompetenciesStrong stakeholder managementAnalytical thinkingNegotiation skillsReport writingRisk-based decision makingExecutive communicationProblem solving
التعليقات
لا توجد تعليقات منشورة حتى الآن.