POSITION OVERVIEW

The Manager - Information Security & Data Privacy is a strategic leadership role responsible for developing and executing comprehensive information security and data privacy programs that protect organizational assets, ensure regulatory compliance, and mitigate technology-related risks. This position requires a seasoned security professional who can balance technical expertise with business acumen to implement robust security frameworks adhering to international standards including UAE IA, PCI DSS, ISO 27001, GDPR, and other relevant regulations. The role serves as a critical liaison between internal teams, external vendors, and regulatory authorities while addressing risks across technology, privacy, business continuity, and data integrity.

KEY RESPONSIBILITIES
Strategic Security & Privacy Program Management

Develop and execute comprehensive information security and data privacy programs in close collaboration with senior leadership and executive management
Define and implement organization-wide security strategy aligned with business objectives and regulatory requirements
Establish governance frameworks and oversight mechanisms to ensure continuous security program effectiveness
Lead the development of multi-year security roadmaps and strategic initiatives

Risk Assessment & Management

Evaluate organizational risk posture through comprehensive risk assessments and vulnerability analyses
Provide strategic insights and recommendations for mitigating identified threats, vulnerabilities, and security gaps
Conduct regular threat modeling exercises and scenario planning to anticipate emerging security challenges
Develop and maintain risk registers, treatment plans, and mitigation strategies
Implement risk quantification methodologies to support informed decision-making

Regulatory Compliance & Standards Implementation

Implement and maintain compliance with regulatory standards including NESA (UAE IA Standards), PCI-DSS, SWIFT CSP, GDPR, CCPA, and other relevant requirements
Design and execute regular self-assessments, compliance monitoring programs, and internal audits
Coordinate external audits and regulatory examinations, ensuring successful outcomes
Build comprehensive compliance frameworks for all relevant jurisdictions and regulatory bodies
Monitor regulatory landscape for emerging requirements and proactively adapt security programs

Policy, Procedure & Standards Development

Develop and maintain comprehensive information security and data privacy policies, procedures, and standards
Ensure alignment with industry frameworks such as NIST, ISO 27001/27701, COBIT, and ITIL
Create clear, actionable guidelines that balance security requirements with business needs
Establish baseline security controls and configuration standards across technology platforms
Review and update documentation regularly to reflect evolving threats and business requirements

Stakeholder Education & Awareness

Guide stakeholders across the organization to understand and respond to security and privacy requirements within their functional areas
Create comprehensive training programs for employees and executives on regulatory compliance, security best practices, and data privacy
Develop security awareness campaigns to foster a culture of security throughout the organization
Conduct tabletop exercises and simulations to enhance organizational preparedness
Measure and report on training effectiveness and security awareness metrics

Vendor & Third-Party Risk Management

Manage vendor relationships to ensure secure data storage, handling, and processing practices
Conduct comprehensive third-party risk assessments and security due diligence reviews
Monitor and ensure adherence to vendor security and privacy compliance within contracted service-level agreements
Review and negotiate security requirements in vendor contracts and master service agreements
Establish ongoing vendor monitoring programs and periodic reassessments

Data Protection & Privacy Initiatives

Lead critical data protection initiatives including data classification, data loss prevention (DLP), and data lifecycle management
Implement privacy-by-design principles across technology projects and business processes
Develop and maintain data inventory and mapping documentation to support privacy compliance
Establish data retention and disposal policies aligned with regulatory requirements
Manage data subject rights requests and privacy incident response procedures

Security Operations & Incident Response

Serve as key member of Cybersecurity Incident Response Team (CIRT) responsible for handling security incidents and data breaches
Support incident investigations, forensic analysis, and root cause determination
Develop and maintain incident response playbooks and procedures
Coordinate breach notification processes and regulatory reporting requirements
Conduct post-incident reviews and implement lessons learned

Audit, Testing & Compliance Verification

Conduct comprehensive audits, compliance testing, gap analysis, and vulnerability assessments
Implement remediation tracking and validation processes for identified risk findings
Coordinate penetration testing and security assessments with internal and external teams
Develop and maintain compliance evidence and audit readiness documentation
Present audit results and remediation plans to senior management and audit committees

Security Architecture & Technology Controls

Collaborate with cross-functional teams for enterprise architecture review and long-term security planning
Evaluate and implement security technologies including SIEM, DLP, endpoint protection, and identity management solutions
Deploy governance, risk, and compliance (GRC) tools to streamline security operations
Provide security guidance for cloud computing initiatives and digital transformation projects
Assess emerging technologies including blockchain and Web3 for security implications

Performance Measurement & Continuous Improvement

Define quality metrics, key performance indicators (KPIs), and key risk indicators (KRIs) to assess program effectiveness
Establish security dashboards and reporting mechanisms for executive visibility
Conduct maturity assessments using industry frameworks to identify improvement opportunities
Benchmark security posture against industry peers and best practices
Drive continuous improvement initiatives based on metrics, trends, and stakeholder feedback

Knowledge Management & Industry Engagement

Maintain current knowledge base of security laws, regulations, emerging threats, and industry trends
Monitor threat intelligence sources and adapt security controls accordingly
Participate in industry forums, working groups, and professional associations
Contribute to the organization's security thought leadership and external engagement
Share insights and recommendations with leadership to strengthen organizational security maturity

QUALIFICATIONS & REQUIREMENTS
Education

Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or related technical field
Master's degree in Cybersecurity, Information Security Management, or related discipline is highly preferred

Professional Certifications

Information Security & Governance: CISA (Certified Information Systems Auditor), CISM (Certified Information Security Manager), CISSP (Certified Information Systems Security Professional), CRISC (Certified in Risk and Information Systems Control), or COBIT certification
Privacy Management: Certified Information Privacy Professional (CIPP), Certified Information Privacy Manager (CIPM), or certified as Privacy Implementer/Auditor (ISO 27701 Lead Implementer/Auditor)
Additional Certifications (Advantageous): CGEIT, CCSP, CEH, or blockchain/Web3 security certifications

Experience

Over 10 years of progressive experience in information security, data privacy, risk management, or related fields
Minimum 5 years in leadership or management roles with direct team supervision
Extensive experience in banking, financial services, or highly regulated industries
Proven track record of implementing security frameworks and achieving regulatory compliance
Experience managing security programs through audits, examinations, and regulatory reviews

Technical Expertise

Security Frameworks: Expert knowledge of NIST Cybersecurity Framework, ISO 27001/27002/27701, COBIT, and other industry standards
Regulatory Standards: Deep understanding of PCI-DSS, SWIFT CSP, NESA (UAE IA Standards), GDPR, CCPA, and relevant financial regulations
Business Continuity: Familiarity with ISO 22301 and business continuity management principles
Cloud Security: Knowledge of cloud computing security principles, practices, and compliance requirements (AWS, Azure, GCP)
Security Technologies: Experience with security tools including SIEM, IDS/IPS, DLP, IAM, endpoint protection, and vulnerability management platforms

Core Competencies

Leadership & Management: Proven ability to lead security programs, manage teams, and influence senior stakeholders
Risk Management: Advanced skills in conducting risk assessments, impact analysis, vulnerability assessments, and defining treatment strategies
Project Management: Strong project management capabilities including planning, budgeting, resource allocation, and stakeholder management
Communication Skills: Exceptional ability to engage with technical teams, executive management, and business personnel across all organizational levels
Analytical Skills: Expert analytical capabilities to connect security requirements with appropriate controls and business context
Training & Education: Demonstrated ability to train and educate staff in information security and data privacy awareness