Security Engineer - GRC/ISMS

Role: Security Engineer - GRC/ISMS

Locations: Dubai, UAE

Job Type - FTE

Key Responsibilities:

Information Security Governance & ISMS

• Manage and continuously improve the Information Security Management System (ISMS).

• Maintain information security policies, standards, procedures, and guidelines.

• Coordinate ISO 27001 certification and surveillance activities.

• Facilitate ISMS Management Reviews and reporting.

• Monitor security objectives, KPIs, corrective actions, and improvement initiatives.

• Ensure compliance with regulatory and organizational requirements.

Risk Management

• Conduct information security risk assessments across projects, systems, vendors, and business processes.

• Facilitate risk treatment planning with risk owners.

• Monitor risk mitigation progress and escalate overdue actions.

• Support enterprise risk management activities related to cyber and technology risks.

Third-Party & Vendor Security Risk Management

• Perform vendor security assessments and due diligence reviews.

• Review security clauses in the vendor contractual documentation (MSA, SOW, DPA etc.)

• Work closely with Procurement and Legal teams during contract reviews.

• Evaluate SaaS, cloud, managed service providers, and technology vendors for information security and data privacy.

• Identify security, privacy, confidentiality, and compliance risks.

• Recommend practical risk treatment options.

• Maintain third-party risk registers and remediation actions.

Project Security Advisory

• Participate in project reviews and steering committees.

• Ensure security requirements are addressed throughout project lifecycles.

Audit & Compliance

• Coordinate internal and external audits.

• Act as primary liaison for ISO 27001 audits.

• Maintain evidence repositories.

• Track audit findings and remediation plans.

• Provide compliance reporting to management.

Security Incident Governance

• Participate in governance reviews of information security incidents.

• Support investigations, root cause analysis, and lessons learned activities.

• Assess policy violations and control failures.

• Recommend corrective and preventive actions.

Security Awareness

• Support and coordinate security awareness initiatives.

• Measure awareness effectiveness through metrics and reporting.

• Promote a security-conscious culture across the organization.

Required Qualifications:

Education

• Bachelor's or Master's degree in Information Security, Computer Science, Information Systems, or related discipline.

Experience

• 15+ years of overall experience with minimum 10+ years dedicated to Information Security GRC.

• Hands-on experience implementing and maintaining ISO 27001.

• Experience conducting third-party security assessments.

• Experience reviewing technology contracts and security clauses.

• Experience supporting audits and certification activities.

• Experience engaging with business and executive stakeholders.

Preferred Certifications

• CISSP/CISM/CISA

• CRISC

• ISO 27001 Lead Implementer/ Lead Auditor

• CDPSE

• ISO 22301 Lead Auditor / Implementer

Behavioral Competencies

• Strong stakeholder management

• Analytical thinking

• Negotiation skills

• Report writing

• Risk-based decision making

• Executive communication

• Problem solving