This role runs IT and security operations day to day and makes sure every business system is secure by design, from build through to decommissioning. It brings IT and information security together. The role owns IT operations, infrastructure security and security monitoring, and manages IT support. It is also accountable for the IT controls of the ISO 27001 information security management system (ISMS) and for audit preparation. It is a hands-on role that combines technical work with managing partners and suppliers.
Location: DubaiKey responsibilitiesIT Operations & Service DeliveryRun day-to-day IT operations across cloud infrastructure, networks, email and collaboration platforms.Ensure security is built into all systems and architectures, from design through to change and decommissioning.Own the operational integrity of end-user devices and network performance.Run user support operations, setting clear technical standards and meeting agreed Service Level Agreements (SLAs).Deliver the company’s mandatory security awareness training in partnership with the GRC function.Develop IT capacity plans, budgets and technology roadmaps for leadership approval.Security OperationsOversee the operational security posture through continuous infrastructure monitoring and vulnerability management.Administer core security tools, including email gateways, endpoint protection, patching systems, and access controls.Collaborate with the VP of IT GRC and Information Security leadership to ensure alignment on enterprise risk thresholds, threat intelligence, and vulnerability management priorities.Oversee identity and access management, including Joiner/Mover/Leaver (JML) access processes.Act on alerts and findings from the outsourced Security Operations Centre (SOC).Run third-party security reviews of vendors and suppliers.ISO 27001 ISMSImplement and maintain the ISO 27001 ISMS controls across IT.Keep information security policies, procedures and control evidence current and ready for audit.Close IT-related audit findings on agreed timelines.Partner and incident managementManage the Managed Security Partner’s day-to-day work, including SOC services, vulnerability testing and technical compliance tasks.Acts as the technical lead for incident handling, executing swift containment strategies and managing the root-cause investigation and recovery lifecycle.Run regular disaster recovery tests and business continuity reviews with key partners.AIAI Operations & Secure Tool Adoption: Oversee the secure integration, deployment, and day-to-day operations of authorized AI platforms (such as Gemini Enterprise and GitHub Copilot) in strict alignment with GHA’s AI Governance Policy.AI Data Privacy & Prompt Security: Enforce strict data protection protocols and prompt engineering standards across IT systems to prevent the input of Personally Identifiable Information (PII), confidential financial metrics, trade secrets, and intellectual property into unauthorized or public-facing AI tools.AIOps & Automated Incident Response: Implement and manage AIOps capabilities to automate IT service management workflows, triage infrastructure alerts, and streamline threat detection and incident containment in coordination with the outsourced Security Operations Centre (SOC).AI Compliance & Risk Assessment: Monitor AI-enabled IT infrastructure for security vulnerabilities, maintain audit-ready control evidence for ISO 27001 ISMS compliance, and participate in risk assessments for emerging AI implementations.Qualifications and experienceEssentialBachelor's degree in IT, computer science or a related field.8+ years in IT, with at least 3 years leading IT operations and security teamsStrong knowledge of cloud infrastructure, networks, identity and access management, and endpoint security.Experience managing outsourced providers, including a SOC or managed security service.Experience supporting ISO 27001 ISMS implementation and audit preparation.Working knowledge of data protection requirements,including GDPR and the UAE Personal Data Protection LawDesirableExperience with cloud environments, with in-depth knowledge of at least one of Microsoft Azure, AWS or OCI, including designing and securing virtual networks.Relevant certifications are an advantage, such as ITIL, ISO 27001 Lead Implementer or Lead Auditor, or CISM.
Equivalent practical experience is valued equally.Experience with disaster recovery planning and business impact analysis.