Senior Cybersecurity Risk &

Date Posted: 12 November, 2026

Industry: IT Services and IT Consulting

Location: VAPORVM IT SERVICES DMCC

Job Description:

Candidates strictly with one month notice period. Single benefit.

JOB DESCRIPTION

Senior Cybersecurity Risk & Compliance Consultant

1. Job Information

Particulars

Details

Job Title

Senior Cybersecurity Risk & Compliance Consultant

Department

Information Security

Section

IT Security & Risk Management

Reports To

Head of Section

Location

Dubai, United Arab Emirates

Employment Type

Full-Time / Fixed-Term Contract

Job Grade

[Grade]

Job Code

[Code]

1. Job Purpose

The Senior Cybersecurity Risk & Compliance Consultant

will lead cybersecurity governance, risk management, regulatory compliance, and

audit readiness while providing technical security oversight across IT

projects, applications, infrastructure, cloud environments, networks, and

third-party solutions.

The role requires a strong combination of cybersecurity

Governance, Risk & Compliance (GRC) expertise and technical security

knowledge to conduct security architecture reviews, technical risk assessments,

control effectiveness evaluations, and compliance assessments.

The consultant will work closely with IT, cybersecurity,

managed services, business stakeholders, vendors, auditors, and external

consultants to ensure that technology initiatives meet organizational security

requirements and applicable regulatory obligations.

1. Key Responsibilities

A. Cybersecurity Governance, Risk & Compliance

• Implement

and maintain cybersecurity governance practices aligned with applicable

UAE regulatory requirements, including DESC Information Security

Regulation (ISR), ISO 27001, NIST, and organizational security policies.

• Conduct

cybersecurity risk assessments for applications, infrastructure, networks,

cloud services, technology projects, vendors, and significant IT changes.

• Identify,

evaluate, document, and track inherent and residual risks, control gaps,

remediation actions, risk owners, and target closure dates.

• Develop

risk treatment plans and manage security exceptions, formal risk

acceptances, compensating controls, and periodic reviews of accepted

risks.

• Maintain

risk registers and supporting evidence within enterprise GRC platforms

such as RSA Archer or equivalent solutions.

• Monitor

remediation progress and escalate overdue, high, and critical risks to

management and relevant governance committees.

B. Technical Security Reviews & Risk Assessments

• Conduct

technical security reviews of solution architectures, high-level and

low-level designs, implementation plans, and technology proposals before

deployment.

• Assess

security risks associated with on-premises infrastructure, networks,

operating systems, databases, web applications, APIs, cloud platforms,

identity and access management, and security technologies.

• Review

technical configurations, access controls, authentication mechanisms,

encryption, network segmentation, logging and monitoring, vulnerability

management, endpoint protection, and data protection controls.

• Evaluate

technical security assessment reports, vulnerability assessment and

penetration testing findings, and remediation plans.

• Review

cloud and SaaS solutions, system integrations, third-party connectivity,

data flows, hosting arrangements, and data residency requirements against

applicable security and regulatory obligations.

• Assess

security requirements for technology procurement, software and hardware

acquisitions, infrastructure changes, and new implementations.

• Identify

security design weaknesses, misconfigurations, control deficiencies, and

compliance gaps, and recommend practical remediation measures and

compensating controls.

• Verify

that security requirements are addressed before go-live and ensure

unresolved risks are appropriately mitigated or formally accepted by

authorized stakeholders.

C. Security Architecture & Project Assurance

• Act as

a cybersecurity advisor to IT and business projects, ensuring that

security requirements are incorporated from the design and planning

stages.

• Review

proposed solutions against approved security architecture, technology

standards, cybersecurity policies, and regulatory requirements.

• Evaluate

the effectiveness and suitability of security controls and technologies,

including firewalls, Web Application Firewalls (WAF), Endpoint Detection

and Response (EDR), Data Loss Prevention (DLP), Privileged Access

Management (PAM), Identity Governance, security monitoring, and

encryption.

• Collaborate

with infrastructure, network, cloud, application, operations, and managed

services teams to address security gaps and improve control

implementation.

• Provide

documented security review findings, recommendations, conditions for

approval, and risk-based implementation guidance.

D. Policy, Standards & Control Management

• Develop,

review, and maintain cybersecurity policies, standards, procedures, and

Standard Operating Procedures (SOPs).

• Translate

regulatory and framework requirements into implementable technical and

operational security controls.

• Conduct

periodic control assessments to evaluate control design, implementation,

and operating effectiveness.

• Identify

opportunities to strengthen cybersecurity processes, improve control

maturity, and address recurring audit and risk findings.

E. Audit, Compliance & Third-Party Risk Management

• Coordinate

and support internal, external, regulatory, and certification audits,

including evidence collection, control validation, and responses to audit

queries.

• Perform

compliance gap assessments against applicable regulatory frameworks, ISO

27001, NIST, and organizational security requirements.

• Develop

corrective and preventive action plans, track audit observations to

closure, and validate supporting evidence.

• Assess

third-party and managed service provider security risks, including access

management, remote support, subcontracting, data handling, hosting, and

compliance obligations.

• Maintain

audit and compliance documentation and support continuous improvement of

the organization’s cybersecurity governance and risk maturity.

1. Qualifications & Experience

• Minimum

10 years of experience in information security or cybersecurity, with

substantial experience in GRC, technical security assessments, risk

management, and regulatory compliance.

• Demonstrable

hands-on experience conducting technical security reviews and risk

assessments across applications, infrastructure, networks, cloud

environments, and enterprise technology solutions.

• Strong

understanding of security architecture, network security, operating system

and database security, application security, APIs, identity and access

management, encryption, vulnerability management, and security monitoring.

• Proven

experience identifying technical vulnerabilities, evaluating security

controls, assessing remediation plans, and determining residual risk.

• Strong

knowledge of ISO 27001, NIST Cybersecurity Framework, risk management

methodologies, and applicable UAE cybersecurity requirements, including

DESC ISR.

• Experience

with risk registers, audit management, policy governance, third-party risk

assessments, and enterprise GRC platforms such as RSA Archer or

equivalent.

• Experience

working with IT operations, infrastructure, cloud, network, application,

cybersecurity, and managed services teams in large or regulated

environments.

• Strong

analytical, report-writing, stakeholder management, and presentation

skills, with the ability to communicate technical risks and business

implications to senior management.

1. Preferred Certifications

• CISSP

– Certified Information Systems Security Professional

• CISM –

Certified Information Security Manager

• CRISC

– Certified in Risk and Information Systems Control

• CISA –

Certified Information Systems Auditor

• ISO/IEC

27001 Lead Implementer or Lead Auditor

• Relevant

certifications in cloud security, application security, penetration

testing, or cybersecurity risk management.

1. Key Competencies

• Strong

technical security assessment and risk analysis capabilities.

• Ability

to balance technical security requirements, regulatory compliance,

operational constraints, and business objectives.

• Independent

judgment in identifying security gaps and recommending risk-based

remediation.

• Effective

stakeholder engagement, governance reporting, and coordination across

technical and business teams.

• Strong

communication and documentation skills.

• Ability

to work independently and manage multiple security assessments and

compliance initiatives.