Assistant Manager Security Governance And Compliance

Job purpose:

To support the implementation, monitoring, and continuous improvement of the bank’s information security governance and compliance framework. The role assists in maintaining security policies, standards, controls, risk registers, regulatory compliance deliverables, audit coordination, third-party security governance, awareness activities, and management reporting to ensure that the bank’s information assets, systems, and processes remain protected and aligned with internal requirements, regulatory obligations, and industry best practices.

Key accountabilities:

Security governance & compliance

Strategic framework development: Design, implement, and continuously enhance a comprehensive information security governance framework that aligns with the bank’s strategic goals, regulatory obligations, and risk appetite.

Security metrics & reporting: Develop and maintain dashboards and reporting mechanisms that aggregate security control effectiveness, risk posture, and compliance status across the organization.

Policy management: Establish, review, and enforce enterprise-wide security policies, standards, and procedures to ensure consistent implementation and adherence.

Awareness & training: Lead the development and delivery of targeted security awareness programs, including phishing simulations, role-based training, and executive briefings to foster a culture of security.

Regulatory compliance: Ensure ongoing compliance with international and UAE-specific regulatory frameworks and standards such as ISO/IEC 27001, NIST, PCI-DSS, NESA, UAE IA, SWIFT CSP, and others.

Security assurance

Risk & vulnerability management: Conduct comprehensive risk assessments and vulnerability analyses across various domains including ISMS, projects, change initiatives, thematic reviews, and third-party engagements.

Threat modelling & DevSecOps integration: Implement threat modelling practices within the software development lifecycle and change management processes to proactively identify and mitigate risks.

Third-party risk management: Oversee a robust third-party security assessment program that spans the entire supplier lifecycle—from onboarding and due diligence to ongoing monitoring and offboarding.

Collaboration & strategic engagement

Cross-functional integration: Partner with business units, IT, legal, compliance, and risk teams to embed security into business processes, digital transformation initiatives, and strategic projects.

Security advocacy & thought leadership: Stay abreast of emerging threats, technologies, and industry trends. Share insights with internal stakeholders and contribute to the bank’s strategic security roadmap.