Information Security Risk Manager

Information Security Risk ManagerDubaiWe are looking for an experienced Information & Cybersecurity Risk Manager to lead the design, governance and ongoing development of an enterprise-wide cyber-risk management framework.This is a senior leadership position for someone who can move an organisation beyond traditional compliance-led GRC towards proactive, business-owned and data-driven cyber-risk management.What you’ll doLead and evolve the organisation’s information and cybersecurity risk-management framework.Establish consistent risk methodologies, governance and reporting across a complex global business.Drive accountability for information risk within business and technology teams.Lead cyber-risk governance forums and provide clear, board-ready reporting on key risks, treatment plans and exposure.Ensure material residual risks are appropriately escalated, formally accepted and tracked.Prioritise and coordinate risk assessments across critical technology environments, business processes, major programmes and third parties.Introduce and mature quantitative risk practices, including probabilistic assessment, risk simulation and loss modelling.Partner with Enterprise Risk, Internal Audit, Privacy, Safety and senior technology stakeholders.Support the assessment and management of emerging risks, including AI and agentic AI.Lead targeted cyber-awareness and behavioural-change initiatives.Develop and upskill a high-performing cyber-risk function.What we’re looking for10+ years’ experience across cybersecurity, information security, technology risk or GRC.Proven experience leading enterprise-wide cyber or information-risk programmes within a large, complex organisation.Strong executive and board-level stakeholder management, with the ability to translate cyber risk into commercial and operational impact.Genuine experience with cyber-risk quantification, data-led risk analysis or advanced risk modelling.Strong knowledge of global cybersecurity, privacy and data-protection regulations.Experience assessing risks across cloud, technology transformation, third parties and enterprise business processes.CRISC certification is essential.CISM, CISA or equivalent certifications are highly desirable.Previous people-leadership and risk-function development experience.Background in aviation, transport, financial services, government, consulting or another highly regulated environment would be advantageous.