IT Security - Risk Management
Menschen Consulting Pvt. Ltd. · Dubai, United Arab Emirates
Tailor my CV for this job — freeJob Information
The consultant will work closely with IT, Cybersecurity, Managed Services, business stakeholders, vendors, auditors, and external consultants to ensure that technology initiatives meet organizational security requirements and applicable regulatory obligations.Key ResponsibilitiesCybersecurity Governance, Risk & ComplianceImplement and maintain cybersecurity governance practices aligned with applicable UAE regulatory requirements, including DESC Information Security Regulation (ISR), relevant sector-specific requirements, ISO 27001, NIST, and organizational security policies.Conduct cybersecurity risk assessments for applications, infrastructure, networks, cloud services, technology projects, vendors, and significant IT changes.Identify, evaluate, document, and track inherent and residual risks, control gaps, remediation actions, risk owners, and target closure dates.Develop risk treatment plans and manage security exceptions, formal risk acceptances, compensating controls, and periodic reviews of accepted risks.Maintain risk registers and supporting evidence within the enterprise GRC platform, such as RSA Archer or an equivalent solution.Monitor remediation progress and escalate overdue, high, and critical risks to management and relevant governance committees.Technical Security Reviews & Risk AssessmentsConduct technical security reviews of solution architectures, high-level and low-level designs, implementation plans, and technology proposals before deployment.Assess security risks associated with on-premises infrastructure, networks, operating systems, databases, web applications, APIs, cloud platforms, identity and access management, and security technologies.Review technical configurations, access controls, authentication mechanisms, encryption, network segmentation, logging and monitoring, vulnerability management, endpoint protection, and data protection controls.Evaluate technical security assessment reports, vulnerability assessment and penetration testing findings, and remediation plans; validate the adequacy of proposed corrective actions and residual risk.Review cloud and SaaS solutions, system integrations, third-party connectivity, data flows, hosting arrangements, and data residency requirements against applicable security and regulatory obligations.Assess security requirements for technology procurement, software and hardware acquisitions, infrastructure changes, and new implementations.Identify security design weaknesses, misconfigurations, control deficiencies, and compliance gaps, and recommend practical remediation measures and compensating controls.Verify that security requirements are addressed before go-live and ensure that unresolved risks are appropriately mitigated or formally accepted by authorized stakeholders.Security Architecture & Project AssuranceAct as a cybersecurity advisor to IT and business projects, ensuring that security requirements are incorporated from the design and planning stages.Review proposed solutions against approved security architecture, technology standards, cybersecurity policies, and regulatory requirements.Evaluate the effectiveness and suitability of security controls and technologies, including firewalls, web application firewalls, endpoint detection and response, data loss prevention, privileged access management, identity governance, security monitoring, and encryption.Collaborate with infrastructure, network, cloud, application, operations, and managed service teams to address security gaps and improve control implementation.Provide documented security review findings, recommendations, conditions for approval, and risk-based implementation guidance.Policy, Standards & Control ManagementDevelop, review, and maintain cybersecurity policies, standards, procedures, and standard operating procedures (SOPs).Translate regulatory and framework requirements into implementable technical and operational security controls.Conduct periodic control assessments to evaluate control design, implementation, and operating effectiveness.Identify opportunities to strengthen cybersecurity processes, improve control maturity, and address recurring audit and risk findings.Audit, Compliance & Third-Party Risk ManagementCoordinate and support internal, external, regulatory, and certification audits, including evidence collection, control validation, and responses to audit queries.Perform compliance gap assessments against applicable regulatory frameworks, ISO 27001, NIST, and organizational security requirements.Develop corrective and preventive action plans, track audit observations to closure, and validate supporting evidence.Assess third-party and managed service provider security risks, including access management, remote support, subcontracting, data handling, hosting, and compliance obligations.Maintain audit and compliance documentation and support continuous improvement of the organization's cybersecurity governance and risk maturity.Qualifications and ExperienceMinimum 10 years of experience in information security or cybersecurity, with substantial experience in GRC, technical security assessments, risk management, and regulatory compliance.Demonstrable hands-on experience conducting technical security reviews and risk assessments across applications, infrastructure, networks, cloud environments, and enterprise technology solutions.Strong understanding of security architecture, network security, operating system and database security, application security, APIs, identity and access management, encryption, vulnerability management, and security monitoring.Proven experience identifying technical vulnerabilities, evaluating security controls, assessing remediation plans, and determining residual risk.Strong knowledge of ISO 27001, NIST Cybersecurity Framework, risk management methodologies, and applicable UAE cybersecurity requirements, including DESC ISR.Experience with risk registers, audit management, policy governance, third-party risk assessments, and enterprise GRC platforms such as RSA Archer or equivalent.Experience working with IT operations, infrastructure, cloud, network, application, cybersecurity, and managed service teams in large or regulated environments.Strong analytical, report-writing, stakeholder management, and presentation skills, with the ability to communicate technical risks and business implications to senior management.Preferred CertificationsCISSP – Certified Information Systems Security ProfessionalCISM – Certified Information Security ManagerCRISC – Certified in Risk and Information Systems ControlCISA – Certified Information Systems AuditorISO/IEC 27001 Lead Implementer or Lead AuditorRelevant certifications in cloud security, application security, penetration testing, or cybersecurity risk management.Key CompetenciesStrong technical security assessment and risk analysis capabilities.Ability to balance technical security requirements, regulatory compliance, operational constraints, and business objectives.Independent judgment in identifying security gaps and recommending risk-based remediation.Effective stakeholder engagement, governance reporting, and coordination across technical and business teams.