Security Engineer - GRC/ISMS

Role: Security Engineer - GRC/ISMS

Locations: Dubai, UAE

Job Type - FTE

Key Responsibilities:

Information Security Governance & ISMS

• Manage and continuously improve the Information Security Management System (ISMS).
• Maintain information security policies, standards, procedures, and guidelines.
• Coordinate ISO 27001 certification and surveillance activities.
• Facilitate ISMS Management Reviews and reporting.
• Monitor security objectives, KPIs, corrective actions, and improvement initiatives.
• Ensure compliance with regulatory and organizational requirements.

Risk Management

• Conduct information security risk assessments across projects, systems, vendors, and business processes.
• Facilitate risk treatment planning with risk owners.
• Monitor risk mitigation progress and escalate overdue actions.
• Support enterprise risk management activities related to cyber and technology risks.

Third-Party & Vendor Security Risk Management

• Perform vendor security assessments and due diligence reviews.
• Review security clauses in the vendor contractual documentation (MSA, SOW, DPA etc.)
• Work closely with Procurement and Legal teams during contract reviews.
• Evaluate SaaS, cloud, managed service providers, and technology vendors for information security and data privacy.
• Identify security, privacy, confidentiality, and compliance risks.
• Recommend practical risk treatment options.
• Maintain third-party risk registers and remediation actions.

Project Security Advisory

• Participate in project reviews and steering committees.
• Ensure security requirements are addressed throughout project lifecycles.

Audit & Compliance

• Coordinate internal and external audits.
• Act as primary liaison for ISO 27001 audits.
• Maintain evidence repositories.
• Track audit findings and remediation plans.
• Provide compliance reporting to management.

Security Incident Governance

• Participate in governance reviews of information security incidents.
• Support investigations, root cause analysis, and lessons learned activities.
• Assess policy violations and control failures.
• Recommend corrective and preventive actions.

Security Awareness

• Support and coordinate security awareness initiatives.
• Measure awareness effectiveness through metrics and reporting.
• Promote a security-conscious culture across the organization.

Required Qualifications:

Education

• Bachelor's or Master's degree in Information Security, Computer Science, Information Systems, or related discipline.

Experience

• 15 years of overall experience with minimum 10 years dedicated to Information Security GRC.
• Hands-on experience implementing and maintaining ISO 27001.
• Experience conducting third-party security assessments.
• Experience reviewing technology contracts and security clauses.
• Experience supporting audits and certification activities.
• Experience engaging with business and executive stakeholders.

Preferred Certifications

• CISSP/CISM/CISA
• CRISC
• ISO 27001 Lead Implementer/ Lead Auditor
• CDPSE
• ISO 22301 Lead Auditor / Implementer

Behavioral Competencies

• Strong stakeholder management
• Analytical thinking
• Negotiation skills
• Report writing
• Risk-based decision making
• Executive communication
• Problem solving