information security lead

Dragonfli Group LLC

<div><p><b>About Dragonfli Group</b></p><p>
Dragonfli Group is an elite cybersecurity and IT advisory firm specializing in security operations, architecture, governance, and technology implementation for enterprise and regulated industry clients. We are a certified small business with deep experience across federal, financial services, utilities, and professional services sectors.</p><p></p><p><b><br>
Overview</b></p><p><b>
Location:</b> Washington, DC or Boston, MA or Dayton, OH preferred;</p><p>
Dragonfli Group is seeking an Information Security Compliance Lead for a high-stakes, client-facing engagement. This is a pure-play GRC role supporting an active information security program within a premier client environment. The successful candidate will act as a primary lead for the GRC function, requiring deep compliance execution experience, exceptional professional presence, and the ability to operate with total autonomy from day one. The right candidate will be able to manage audit cycles and platform implementations immediately.</p><p></p><p><b><br>
Responsibilities:</b></p><ul><li>
Independently complete complex client security questionnaires and audit responses using established firm precedent and maintain organized submission records.
</li><li>Lead compliance monitoring and enforcement against ISO 27001 and ISO 42001 (AI Management System).
</li><li>Directly manage the 30-day implementation and optimization of the Vanta trust center platform.
</li><li>Conduct and document risk assessments, policy reviews, and audit evidence gathering for an upcoming audit window.
</li><li>Develop and maintain cybersecurity policies and procedures aligned to regulatory requirements and AI/ML-enabled monitoring.
</li><li>Deliver and track compliance training and awareness initiatives; report outcomes to leadership.
</li><li>Interface directly with client legal, compliance, and IT stakeholders as a polished representative of the firm.</li></ul><br>
Requirements:<br>
<br>
<p><b>Minimum Qualifications</b></p><ul><li>
2-5+ years supporting information security in large, complex environments (Law firm or Big 4 experience strongly preferred).
</li><li>Expert-level working knowledge of ISO 27001 and NIST CSF.
</li><li>Proven experience implementing or managing Vanta or equivalent trust center platforms.
</li><li>Exceptional written and interpersonal communication skills; ability to produce &quot;client-ready&quot; deliverables without internal oversight.
</li><li>Bachelor's degree in computer science, information security, or related field; equivalent experience considered.
</li><li>Preferred certifications: CISSP, CISA, or CompTIA Security+</li></ul><br>
Skill(s):
<br>
<ul><li>GRC platform expertise (Vanta, OneTrust, Archer, or ServiceNow GRC).
</li><li>Security questionnaire automation tools (Whistic, Responsive, Loopio).
</li><li>Third-party risk management (TPRM) fundamentals and SOC 2 Type I/II audit support. GDPR, CCPA, and AI privacy regulation familiarity.
</li><li>Evidence collection, audit artifact management, and policy lifecycle management.
</li><li>Risk register development and maintenance.
</li><li>Business continuity and disaster recovery documentation support.
</li><li>Strong proficiency in Microsoft 365 (SharePoint, Teams, Word, Excel) for collaboration.
</li><li>Experience working in a ticketing or GRC workflow environment (Jira, ServiceNow).</li></ul></div>

Information Security Compliance Lead

<div><div><div><div>All locations
</div></div><div><ul><li>Al Khobar, Saudi Arabia</li>
<li>Jeddah, Saudi Arabia</li>
</ul></div><div><div>Business:</div>
<div>Business Assurance</div>
</div><div><div>Position type:</div>
<div>Full Time</div>
</div><div><div>Contract type:</div>
<div>Permanent Employee</div>
</div><div><div>Job ID:</div>
<div>6598</div></div></div></div>
<br><div><div><div><div><div><h2 class="jobSectionHeader"><b>Benefits</b></h2>
<p>Please note, benefits may depend on your contract type, please confirm with your recruiter.</p>
<div><div><div><div><div><div><h3 class="jobSectionHeader"><b>Profit Share</b></h3>
</div><p>You&rsquo;ll be part of our global profit share scheme that means we all share in our success as a business. If we profit, so do you. This will be part of our Total Compensation approach each year and depends on our year-end results.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Insurance</b></h3>
</div><p>Taking care of you with travel, life, and accident insurance.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Pension Schemes</b></h3>
</div><p>We care about your long-term financial security and prioritize pension and retirement benefits to reflect our caring values.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Professional Development</b></h3>
</div><p>We believe in the 70/20/10 learning model, where 70% of your learning comes from performing your everyday tasks and working on different projects, new areas and initiatives to gain new skills. 20% from working with others and mentoring and the rest from formal education.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Hybrid Working</b></h3>
</div><p>Adapting to the changing world of work around the world.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Purpose-led organization</b></h3>
</div><p>You become part of a world-leading company where we know and live our purpose; to safeguard life, property, and the environment, with the opportunity to tackle global change through your work.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Supportive and caring culture</b></h3>
</div><p>We offer opportunities to connect through social and professional networks. Our largest community CONNECT, organizes after-work events and informal meetings throughout the year.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Attractive rewards</b></h3>
</div><p>We focus on work/life balance and offer employees flexible working hours and workplace, annual vacation allowance, competitive pension, insurance, and a global profit share scheme.</p><br>
</div></div></div></div></div></div></div></div></div><p></p><div><div><div><div><h2 class="jobSectionHeader"><b>Diversity, Equity and Inclusion</b></h2>
<div><p>At DNV, our commitment to Diversity, Equity, and Inclusion is not only an ethical choice, but also a business decision.</p>
</div><div></div><p>Diversity, fairness, and a sense of belonging are a source of strength for our people, our business, and our customers, and help us to deliver on our purpose, vision, and values.</p><br>
 </div></div></div></div><div></div><div><div><div><div><div><div><div>Transcript
</div></div><div><div><div><p>Business Assurance is a unit of DNV where we are working with our customers towards verifying them if they are compliant with some particular rules. We are responsible for scheduling audits. We need to assign the right person with the right competences to conduct such an audit. And we are analysing and improving their processes. But sometimes we need to register some findings like observation, opportunity for improvement, or even non-conformities. I verify our clients' system management by observing them, how they work, how they produce. It's very interesting because we are delivering some additional information for our customers, what they cannot see or discover in their own systems. My work life as an auditor is completely different than employees who are working from the office every day. Because usually I'm travelling to our customers that are located in a different part of our country. Almost every week I work with different people in different companies. So if you like travel, if you are well organized, DNV can be for you.</p>
</div></div></div></div></div></div></div></div><div></div><div><div><div><div><h2 class="jobSectionHeader"><b>Working here</b></h2>
<div><p>Since 1864 we&rsquo;ve been dedicated to safeguarding life, property and the environment. Today we remain at the forefront of new technologies and techniques to help our customers transform for a more sustainable future.</p>
</div><div></div><p>At DNV you can expect to deliver career and industry defining work. You&rsquo;ll be given the time to build your network, the resources to support your development, and the freedom to satisfy your curiosity and desire to learn.</p></div></div></div></div></div>

Information security Lead Auditor (Kingdom of Saudi Arabia)

KPMG

<div><p>Known for being a great place to work and build a career, KPMG provides audit, tax and advisory services for organizations in today's most important industries. Our growth is driven by delivering real results for our clients. It's also enabled by our culture, which encourages individual development, embraces an inclusive environment, rewards innovative excellence and supports our communities. With qualities like those, it's no wonder we're consistently ranked among the best companies to work for by Fortune Magazine, Consulting Magazine, Seramount, Fair360 and others. If you're as passionate about your future as we are, join our team.</p>
<p>KPMG is currently seeking an Associate Director, Regional Information Security Awareness Lead to join our Global Technology and Knowledge Group which is part of KPMG International organization.</p><h3 class="jobSectionHeader"><b>
Responsibilities:</b></h3><ul><li>
Support Regional Security Hub &amp; RISO in advising member firms on the implementation of KPMG information risk and security standards / requirements</li><li>
Assist the RISO and member firm security representatives to plan and execute regional cyber adoption campaigns</li><li>
Aid the Regional Security Hub &amp; RISO and member firm security representatives to establish and maintain cyber dashboard to be aggregated across the region</li><li>
Ensure that regional security adoption and awareness program communicates the security policies and requirements so that people know, understand and can follow them</li><li>
Identify the top human risks to the organization and the behaviors we need to change to mitigate those risks; develop and maintain a security awareness program that effectively changes these behaviors, so the employees act in a secure manner, reducing the most risk to the organization</li><li>
Ensure contextual and security awareness information is updated on regular basis and reflects the latest security standards, trends and threats; structure and maintain this program to be long term.</li><li>
Act with integrity, professionalism, and personal responsibility to uphold KPMG's respectful and courteous work environment</li></ul><h3 class="jobSectionHeader"><b>
Qualifications:</b></h3><ul><li>
Minimum seven years of recent experience in working in a corporate environment with at least two years of experience in management position</li><li>
Bachelor's degree from an accredited college/university; master's degree in computer science, information security, information systems, computer engineering, or a related field is required</li><li>
Minimum of at least one industry certification (e.g. CISA, CISM, CRISC, CISSP, ISAAP) required</li><li>
Experience in successfully planning and managing information security awareness projects</li><li>
Significant ongoing involvement in information security industry / professional organizations or comparable programs to demonstrate current cyber security expertise and trend awareness</li><li>
Experience in working in matrix management environment</li><li>
Applicants must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future; KPMG LLP will not sponsor applicants for U.S. work visa status for this opportunity (no sponsorship is available for H-1B, L-1, TN, O-1, E-3, H-1B1, F-1, J-1, OPT, CPT or any other employment-based visa)</li></ul>
<div>KPMG LLP and its affiliates and subsidiaries (&ldquo;KPMG&rdquo;) complies with all local/state regulations regarding displaying salary ranges. If required, the ranges displayed below or via the URL below are specifically for those potential hires who will work in the location(s) listed. Any offered salary is determined based on relevant factors such as applicant's skills, job responsibilities, prior relevant experience, certain degrees and certifications and market considerations. In addition, KPMG is proud to offer a comprehensive, competitive benefits package, with options designed to help you make the best decisions for yourself, your family, and your lifestyle. Available benefits are based on eligibility. Our Total Rewards package includes a variety of medical and dental plans, vision coverage, disability and life insurance, 401(k) plans, and a robust suite of personal well-being benefits to support your mental health. Depending on job classification, standard work hours, and years of service, KPMG provides Personal Time Off per fiscal year. Additionally, each year KPMG publishes a calendar of holidays to be observed during the year and provides eligible employees two breaks each year where employees will not be required to use Personal Time Off; one is at year end and the other is around the July 4th holiday. Additional details about our benefits can be found towards the bottom of our KPMG US Careers site at Benefits &amp; How We Work.</div><div></div><div><br>
Follow this link to obtain salary ranges by city outside of CA:</div>
https://kpmg.com/us/en/how-we-work/pay-transparency.html/?id=3623BPG_9_26
<div><div>KPMG offers a comprehensive compensation and benefits package. KPMG is an equal opportunity employer. KPMG complies with all applicable federal, state and local laws regarding recruitment and hiring. All qualified applicants are considered for employment without regard to race, color, religion, age, sex, sexual orientation, gender identity, national origin, citizenship status, disability, protected veteran status, or any other category protected by applicable federal, state or local laws. The attached link contains further information regarding KPMG's compliance with federal, state and local recruitment and hiring laws. No phone calls or agencies please.</div><div></div><div><br>
KPMG recruits on a rolling basis. Candidates are considered as they apply, until the opportunity is filled. Candidates are encouraged to apply expeditiously to any role(s) for which they are qualified that is also of interest to them.</div><div></div><div><br>
Los Angeles County applicants: Material job duties for this position are listed above. Criminal history may have a direct, adverse, and negative relationship with some of the material job duties of this position. These include the duties and responsibilities listed above, as well as the abilities to adhere to company policies, exercise sound judgment, effectively manage stress and work safely and respectfully with others, exhibit trustworthiness, and safeguard business operations and company reputation. Pursuant to the California Fair Chance Act, Los Angeles County Fair Chance Ordinance for Employers, Fair Chance Initiative for Hiring Ordinance, and San Francisco Fair Chance Ordinance, we will consider for employment qualified applicants with arrest and conviction records.</div></div></div>

Associate Director, Regional Information Security Awareness Lead

Revolut

<div><b>About Revolut</b><p></p><p>
People deserve more from their money. More visibility, more control, and more freedom. Since 2015, Revolut has been on a mission to deliver just that. Our powerhouse of products &mdash; including spending, saving, investing, exchanging, travelling, and more &mdash; help our 70+ million customers get more from their money every day.</p><p>
As we continue our lightning-fast growth,&zwnj; 2 things are essential to our success: our people and our culture. In recognition of our outstanding employee experience, we've been certified as a Great Place to Work&trade;. So far, we have 13,000+ people working around the world, from our offices and remotely, to help us achieve our mission. And we're looking for more brilliant people. People who love building great products, redefining success, and turning the complexity of a chaotic world into the simplicity of a beautiful solution.</p><p></p><b>
About the role</b><p></p><p>
Our Information Security team protects Revolut's systems, data, and people. They combine technical expertise with a proactive, risk-based mindset to stay ahead of threats and keep our technology and customers secure at every step.</p><p>
We're looking for an Information Security Manager to lead our local security strategy and collaborate with regulators, management, and the Risk and Compliance team. You&rsquo;ll oversee the entire security lifecycle, from identifying risks and managing vulnerabilities to ensuring our third-party vendors meet strict standards.</p><p>
Up to shape what's next in finance? Let's get in touch.</p><p></p><b>
What you'll be doing</b><p></p><ul><li>
Classifying information assets according to security requirements and maintaining detailed asset and data inventories</li><li>
Developing, implementing, and regularly updating information security policies, procedures, and standards in line with regulatory requirements (BDDK, ISO 27001, PCI-DSS)</li><li>
Establishing identity authentication mechanisms and network security control systems according to regulatory standards</li><li>
Protecting confidential information and managing limited access permissions for third-party service providers and vendors</li><li>
Establishing and managing cyber incident response processes</li><li>
Identifying, assessing, and prioritising information security risks across systems, networks, and data assets while monitoring mitigation controls</li><li>
Overseeing periodic vulnerability assessments and penetration tests and tracking the remediation of identified weaknesses</li><li>
Ensuring full alignment with BDDK's IT regulations, KVKK, and other applicable frameworks while supporting regulatory audits</li><li>
Designing and testing business continuity and disaster recovery plans to ensure operational resilience</li><li>
Conducting information security awareness activities, including bulletins, communications, and regular phishing simulation tests</li><li>
Providing regular reporting to the board, senior management, and regulatory bodies regarding security posture and control effectiveness</li></ul><p></p><b>
What you'll need</b><p></p><ul><li>
7+ years of experience in information security management, ideally within a regulated financial institution (financial services, banking, or payments)</li><li>
Relevant certifications, such as CISM, CISSP, ISO 27001 Lead Implementer</li><li>
Knowledge of BDDK BS regulation, KVKK, ISO 27001, PCI-DSS, and COBIT</li><li>
A university degree in computer engineering, information systems, or related field</li><li>
Expertise in managing outsourced IT and InfoSec services</li><li>
Experience delivering localised IT and InfoSec policies aligned with regulatory standards</li><li>
Excellent stakeholder management and communication skills</li></ul><p></p><p><i>
Building a global financial super app isn&rsquo;t enough. Our Revoluters are a priority, and that&rsquo;s why in 2021 we launched our inaugural D&amp;I Framework, designed to help us thrive and grow everyday. We're not just doing this because it's the right thing to do. We&rsquo;re doing it because we know that seeking out diverse talent and creating an inclusive workplace is the way to create exceptional, innovative products and services for our customers. That&rsquo;s why we encourage applications from people with diverse backgrounds and experiences to join this multicultural, hard-working team.</i></p><p><b><i>
Important notice for candidates:</i></b></p><p><i>
Job scams are on the rise. Please keep these guidelines in mind when applying for any open roles.</i></p><ul><li><b><i>Only apply through official Revolut channels.</i></b><i> We don&rsquo;t use any third-party services or platforms for our recruitment.</i></li><li><b><i>Always double-check the emails you receive.</i></b><i> Make sure all communications are being done through official Revolut emails, with an @revolut.com domain.</i></li></ul><p><b><i>
We won't ask for payment or personal financial information during the hiring process.</i></b><i> If anyone does ask you for this, it&rsquo;s a scam. Report it immediately.</i></p><p><i>
By submitting this application, I confirm that all the information given by me in this application for employment and any additional documents attached hereto are true to the best of my knowledge and that I have not wilfully suppressed any material fact. I confirm I have disclosed if applicable any previous employment with Revolut. I accept that if any of the information given by me in this application is in any way false or incorrect, my application may be rejected, any offer of employment may be withdrawn or my employment with Revolut may be terminated summarily or I may be dismissed. By submitting this application, I agree that my personal data will be processed in accordance with Revolut's </i><i>Candidate Privacy Notice</i></p><p>
Notice: This is a remote position based in Turkey.</p></div>

Information Security Manager

Aldar Academies

<div><p>Aldar Education is currently seeking a <b>UAE National Manager &ndash; Information Security </b>for an <b>immediate </b>start in Abu Dhabi to support our growing family of owned and operated schools in the UAE. This is an exciting opportunity to join the highly successful Aldar family of schools and to help shape the future of Abu Dhabi&rsquo;s leading school group.
</p><p>This position is responsible for implementing Information Security across Aldar Education, ensuring the effective implementation of security programmes, day-to-day cyber security operations, and implementing long-term security strategy across all HQ and school environments. The Manager will work closely with the Senior Manager and IT Infrastructure team to embed security controls at every layer of the technology estate, and liaison with the Group InfoSec team and internal teams to align governance, policies, and enterprise-wide security standards. The role leads the organisation's response to cyber threats, drives a culture of security awareness, and ensures Aldar Education's posture is continuously strengthened in line with modern cyber security practices.
</p><p>Since its inception in 2007 with just 250 students, Aldar Education has grown into a highly sought-after education provider, with more than 25 owned and managed premium and super-premium schools and academies- in partnership with some of the world&rsquo;s most prestigious institutions including Rugby School, King&rsquo;s College Wimbledon, and Cranleigh. The Group now serves over 38,000 students through 5,000 educators from more than 100 nationalities to deliver world-class education across a broad range of curricula and learning pathways from nursery through to K12.
</p><p>At Aldar Education, our impact goes far beyond the classroom: we are proud to contribute to the UAE&rsquo;s vision for a sustainable, knowledge-based economy through premium education. With this in mind, we hire educators and industry professionals who not only embody our values and cultural ethos but also bring a genuine passion for education&mdash;qualities central to our mission of shaping the leaders of tomorrow.
</p><p>If you are passionate about excellence and ready to make a meaningful impact, we invite you to apply and be part of our journey.</p></div>
<br><div><p><b>Minimum Qualifications
</b></p><ul><li>Bachelor's degree in Computer Science, Information Security, Cybersecurity, or a related discipline.
</li><li>ISO/IEC 27001 Lead Implementer or Lead Auditor certification (required).
</li><li>CISSP (Certified Information Systems Security Professional) or CISM (Certified Information Security Manager) &mdash; required or strongly preferred.
</li><li>Cloud security certification such as CCSP, Microsoft AZ-500 (Azure Security Engineer), or equivalent (preferred).
</li><li>CRISC (Certified in Risk and Information Systems Control) or equivalent risk certification (advantageous).
</li></ul><p><b>Minimum Experience
</b></p><ul><li>Minimum 5 years' experience in Information Security or Cybersecurity roles.
</li><li>Demonstrable experience managing security in a cloud-heavy environment (Microsoft 365 / Azure or equivalent).
</li><li>Proven experience with SOC operations, incident response, and threat intelligence programmes.
</li><li>Strong understanding of ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, and UAE data protection regulations (PDPL).
</li><li>Strong understanding of enterprise risk management frameworks.
</li></ul><p><b>Job Specific Knowledge &amp; Skills
</b></p><p><b>Job Specific Knowledge:
</b></p><ul><li>Zero Trust Architecture principles and practical implementation across network, identity, and application tiers.
</li><li>Cloud Security Posture Management (CSPM) and Cloud Native Application Protection Platforms (CNAPP).
</li><li>Identity and Access Management (IAM) and Privileged Access Management (PAM) &mdash; e.g., Microsoft Entra ID, CyberArk, or equivalent.
</li><li>SIEM and SOAR platforms &mdash; correlation rule development, playbook automation, alert triage, and tuning.
</li><li>Extended Detection and Response (XDR) and Endpoint Detection and Response (EDR) platforms.
</li><li>Data Loss Prevention (DLP) and data classification policy design and enforcement.
</li><li>Web Application Firewall (WAF) management, tuning, and API security.
</li><li>Vulnerability Management &mdash; full VMDR lifecycle from discovery through remediation validation.
</li><li>Network security &mdash; next-generation firewalls, DNS security, micro-segmentation, and network access control.
</li><li>Threat intelligence platforms and practical application of the MITRE ATT&amp;CK framework.
</li><li>Security awareness programme design and phishing simulation platforms.
</li><li>Business Continuity and Disaster Recovery planning, testing, and improvement.
</li><li>Compliance and risk assessment aligned to ISO 27001, NIST, CIS, and UAE regulatory requirements.
</li><li>Secure-by-design and DevSecOps principles for integration into technology delivery lifecycles.
</li></ul><p><b>General Skills:
</b></p><ul><li>Strong analytical and critical thinking skills with the ability to assess complex risk scenarios.
</li><li>Excellent written and verbal communication &mdash; able to convey technical risk clearly to non-technical stakeholders.
</li><li>Strong interpersonal skills with the ability to influence and collaborate across teams and functions.
</li><li>Highly self-motivated with keen attention to detail and a continuous improvement mindset.
</li><li>Ability to prioritise and manage competing demands effectively in a high-pressure environment.
</li><li>Commercial awareness and the ability to balance security requirements with business and operational needs.
</li></ul><p><b>What We Offer:
</b></p><p>Aldar Education is a family of world-class, child-centered, and innovative schools based in the UAE. We educate students across our group of owned and managed schools and as we grow, so does our need for highly skilled, inspirational, and dedicated school and educational leaders. We offer an attractive remuneration package including a range of benefits. Our future-focused learning model includes both students and staff, so we place a special emphasis on professional development, coaching, and training.
</p><p>Successful candidates will have access to a wide network of professionals and opportunities to both lead and contribute to training others as well as developing themselves.
</p><p>This job description is not all-inclusive. Aldar Education reserves the right to amend this job description at any time. We are an equal opportunity employer, committed to a diverse and inclusive work environment. We are dedicated to our national development strategy and encourage UAE Nationals in their application to our company.
</p><p><b>Aldar Education is committed to safeguarding and promoting the welfare of children and young people and expects all staff to share this commitment. Offers of appointment are subject to satisfactory references and police clearance.</b></p></div>
<br><div><p><b>Main Duties
</b></p><ul><li>Partner with teams to implement and maintain enterprise-wide information security governance, policies, and controls across all Aldar Education schools and HQ.
</li><li>Design and implement, and continuous improvement of a Zero Trust security architecture across network, identity, and application layers.
</li><li>Manage a comprehensive information security programme aligned to ISO/IEC 27001, NIST Cybersecurity Framework (CSF), CIS Controls, and applicable UAE data protection regulations including PDPL.
</li><li>Enforce and implement Identity and Access Management (IAM) and Privileged Access Management (PAM) controls to enforce least-privilege principles across all systems and platforms.
</li><li>Implement the organisation's cloud security posture, including security configurations for Microsoft 365, Azure, and other cloud platforms used across Aldar Education, leveraging CSPM and CNAPP tooling.
</li><li>Follow Incident Response lifecycle &mdash; detection, containment, eradication, recovery, and post-incident review &mdash; ensuring lessons learned are captured and controls are strengthened.
</li><li>Proactively support regular threat intelligence reviews, vulnerability assessments, and penetration testing to proactively identify and remediate risks across the environment.
</li><li>Maintain, regularly test, and improve Business Continuity and Disaster Recovery plans for all critical IT systems and data assets.
</li><li>Develop, enforce, and review data classification and Data Loss Prevention (DLP) policies to protect student, staff, and institutional data across all environments.
</li><li>Implement security awareness programme &mdash; including phishing simulation exercises &mdash; for all staff, contractors, and system users to build a security-conscious culture.
</li><li>Follow security-by-design and DevSecOps principles into all technology projects, system implementations, and application development lifecycles.
</li><li>Monitor emerging threats, vulnerabilities, attacker techniques (using MITRE ATT&amp;CK), and regulatory changes; advise leadership on appropriate and timely risk responses.
</li><li>Liaise with Operations, Infrastructure, and Application teams to ensure consistent application of security controls across all layers of the IT environment.
</li></ul><p><b>Specific Duties
</b></p><ul><li>Optimise the Darktrace AI-powered email and network security solution, including regular model tuning to reduce false positives and improve detection fidelity.
</li><li>Administer continuous vulnerability management, patch prioritisation, and web application security scanning across all environments.
</li><li>Manage the Extended Detection and Response (XDR) platform to correlate endpoint, identity, network, and cloud telemetry for unified, high-fidelity threat detection and response.
</li><li>Administer the Microsoft 365 Defender suite &mdash; including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps &mdash; to protect the organisation's collaboration and productivity environment.
</li><li>Implement and maintain ISMS controls across server and network infrastructure, ensuring ongoing alignment with ISO/IEC 27001 certification requirements.
</li><li>Plan and coordinate IT security audits &mdash; both internal reviews and third-party assessments &mdash; to satisfy ISMS, regulatory, and Group requirements.
</li><li>Implement and manage a Cloud Access Security Broker (CASB) to enforce data security policies and monitor shadow IT across cloud services used by staff and students.
</li><li>Manage Web Application Firewall (WAF) and Bot Manager to protect web-facing applications and APIs from application-layer attacks and automated threats.
</li><li>Manage DNS ETP and EdgeDNS for secure DNS resolution, malicious domain filtering, and endpoint traffic protection.
</li><li>Oversee Mobile Device Management (MDM) security policies &mdash; including BYOD controls &mdash; for all student and staff devices across the estate.
</li><li>Coordinate and supervise approved vendors to perform VAPT and DR tests; review findings, prioritise and track remediation to closure.
</li><li>Manage cloud security posture for Azure and Microsoft 365 environments using Microsoft Secure Score, Defender for Cloud, and associated compliance dashboards.
</li><li>Coordinate with principal vendors for new security projects and the resolution of operational security issues, ensuring accountability and timely delivery.</li></ul></div>

Manager – Business Information Security (UAE National)

Trufla Technology

<div><b>Think insurance is boring? Think again.</b><b> </b>Trufla is a multinational Canadian company and the first of its kind &ndash; we offer a complete suite of digital solutions for the modern insurance brokerage. From SEO and web design, to lead management, branded customer service and API&rsquo;s, Trufla provides a 360&deg; digital strategy for brokerages and reimagines the way their customers interact with insurance. <b>Trufla is leading a digital revolution</b> that will transform the insurance industry! We&rsquo;re growing fast, and we&rsquo;re looking for visionaries to join our team of innovators and disruptors at our Cairo offices. It&rsquo;s our goal for Trufla to be the <b>BEST place to work</b>. A great corporate culture is one of our top priorities. <b>Main Benefits:</b><br>
<ul><li>
Competitive Salary</li><li>
Health Insurance</li><li>
Gym Membership</li><li>
Flexible Working Hours</li><li>
Continuing Education Opportunities</li><li>
Work from home</li><li>
Team Building Activities</li><li>
Milestone celebrations &ndash; work anniversaries, birthday celebrations, etc.</li></ul><h3 class="jobSectionHeader"><b><br>
About the Role</b></h3><br>
As Head of IT &amp; Security, you will serve as the senior leader of Trufla's Information Technology and Security function, working closely with our teams in Canada and Egypt. You will own the company's technology infrastructure and security posture end-to-end &mdash; driving strategy, implementation, and continuous improvement across all IT and cybersecurity domains.You will be responsible for addressing evolving and pervasive issues such as identity theft, data security breaches, data leakage, cyber intelligence, and system outages, with the goal of enabling secure and reliable operations across the organization. A core mandate of this role is leading Trufla's <b>SOC 2 compliance program</b> &mdash; from initial gap assessment through to certification and ongoing maintenance.You will apply deep security and infrastructure skills to design, build, and protect enterprise systems, applications, data, assets, and people, while also providing guidance to help clients protect their information, infrastructures, applications, and business processes against cyber threats.
<br>
<h3 class="jobSectionHeader"><b>Responsibilities</b></h3><br>
<b>
Leadership &amp; Strategy</b><ul><li>
Own and drive the IT and Security roadmap, aligning it with Trufla's business objectives</li><li>
Lead, mentor, and grow the IT &amp; Security team across Cairo and Canada offices</li><li>
Act as the primary point of escalation for all IT and security-related matters</li><li>
Report on IT and security program health, KPIs, and risk posture to senior leadership</li><li>
Manage vendor relationships, contracts, and procurement for IT and security tooling
</li></ul><b>SOC 2 Compliance</b><ul><li>
Lead the end-to-end implementation of SOC 2 (Type I and Type II) compliance across the organization</li><li>
Conduct gap assessments against SOC 2 Trust Service Criteria (Security, Availability, Confidentiality, Processing Integrity, and Privacy)</li><li>
Develop, document, and enforce the policies, procedures, and controls required to meet SOC 2 requirements</li><li>
Coordinate with external auditors and manage the audit process through to successful certification</li><li>
Maintain and continuously improve SOC 2 compliance posture post-certification, ensuring controls remain effective and audit-ready year over year</li><li>
Train and align internal stakeholders on their responsibilities within the SOC 2 control framework</li></ul><br>
<b>
Security</b><ul><li>
Demonstrate a thorough understanding of business processes, risk management, IT controls, and related standards</li><li>
Identify and evaluate business and technology risks; design and implement appropriate controls, technologies, and processes to mitigate them</li><li>
Conduct and oversee capability assessments, developing pragmatic remediation strategies and good practice recommendations</li><li>
Lead the review of security-related events, assessing risk and validity, and producing clear executive reporting</li><li>
Conduct research to maintain and expand knowledge of the latest security technologies, standards, and the evolving threat and vulnerability landscape</li><li>
Work with security vendors to evaluate solution offerings and advise on appropriate technologies</li><li>
Conduct and oversee penetration testing activities</li><li>
Develop and deliver security awareness training programs across the organization</li></ul>
<b>IT Support &amp; Operations</b><ul><li>
Oversee the analysis, diagnosis, and resolution of complex workstation and infrastructure problems for end users in Cairo and remotely for other offices</li><li>
Ensure the installation, configuration, testing, maintenance, monitoring, and troubleshooting of end-user workstations, hardware, software, and telephony equipment</li><li>
Manage and improve incident ticketing processes, ensuring timely response and resolution</li><li>
Oversee move, add, and change (MAC) requests as submitted by line managers</li><li>
Maintain and uphold procedures for logging, reporting, and statistically monitoring workstation operations</li><li>
Liaise with third-party support vendors and software/hardware providers as needed</li><li>
Participate in an on-call rotation for after-hours and weekend critical support</li></ul><br>
<br>
<h3 class="jobSectionHeader"><b>Job Qualifications</b></h3><br>
<ul><li>
College diploma or university degree in Computer Science, Information Security, or a related field, or equivalent professional certification</li><li><b>
7+ years of experience</b> in a Network, IT, or Security role</li><li><b>
3+ years of experience leading an IT or Security team</b></li><li>
Demonstrated hands-on experience implementing or managing <b>SOC 2 compliance</b> (Type I and/or Type II)</li><li>
Strong knowledge of security frameworks and standards (SOC 2, ISO 27001, NIST, CIS Controls)</li><li>
Sound technical knowledge of PC hardware, networking, mobile devices, and related technologies</li><li>
Working knowledge of current operating systems, protocols, and infrastructure standards</li><li>
Experience conducting penetration testing</li><li>
Able to read and understand technical manuals, procedural documentation, and OEM guides</li><li>
Experience working in a team-oriented, collaborative environment across multiple time zones</li></ul>
<b>Personal Attributes</b><ul><li>
Strong leadership presence with the ability to influence at all levels of the organization</li><li>
Excellent written and oral communication skills in English</li><li>
Strong customer-service orientation with effective interpersonal and relationship-building skills</li><li>
Ability to present complex technical concepts in clear, business-friendly language</li><li>
Flexible and adaptable with proven problem-solving ability</li><li>
High degree of professionalism and integrity</li><li>
Demonstrated accountability and reliability in the quality and timeliness of work</li><li>
Self-motivated and directed, with the ability to effectively prioritize and execute in a high-pressure environment</li><li>
Critical thinker with strong attention to detail and a continuous improvement mindset</li></ul><br>
<i>
Trufla is an equal opportunity employer and is committed to all forms of diversity in the workplace. All qualified individuals are encouraged to apply.</i><br>
<b>Do you think we match? Apply Now!</b><b> </b>If you have what it takes, apply to the job through the &quot;Apply Now&quot; button above. *After applying, complete your application by taking the required assessment below:https://app.testgorilla.com/s/bhh62y7z</div>

Head of IT & Security

Bank Alfalah Limited

<div>
 <p>
  Job Purpose:
 </p>
 <p>
  The Governance, Risk &amp; Compliance Manager is responsible for establishing, managing, and continuously improving the organization&rsquo;s information security governance, risk management, and compliance framework. The role ensures alignment with regulatory requirements, industry standards, and business objectives, while providing strategic oversight, leadership, and assurance to senior management
 </p>
 <p>
  <br/>
 </p>
 <p>
  Responsibilities:
 </p>
 <ul>
  <li>
   Support the execution of internal and external information security audits in collaboration with the Team lead.
  </li>
  <li>
   Interpret and implement regulatory requirements and liaise with internal teams to ensure compliance.
  </li>
  <li>
   Facilitate coordination between business and technical teams to conduct comprehensive security reviews.
  </li>
  <li>
   Work with stakeholders to recommend and track risk mitigation measures, ensuring timely closure of identified gaps/observations.
  </li>
  <li>
   Maintain and oversee the information security risk register.
  </li>
  <li>
   Define and maintain risk management framework including risk assessment methodology and risk appetite alignment
  </li>
  <li>
   Coordinate with IT/security teams for mitigation strategies.
  </li>
  <li>
   Assist TL in preparation of reports/presentations for management reporting and ITSC/BITC.
  </li>
  <li>
   Lead and support the development, implementation, and continuous improvement of information security policies, procedures, and governance frameworks to ensure alignment with industry standards and regulatory requirements.
  </li>
  <li>
   Define and monitor KPIs/KRIs to measure effectiveness of security controls and risk posture
  </li>
  <li>
   Ensure organizational policies, processes, and operations achieve full compliance with SBP regulatory requirements, while maintaining alignment with cross‑border regulations.
  </li>
  <li>
   Oversee cyber security and information security (NESA Compliance) programs.
  </li>
  <li>
   Lead risk assessments and ensure compliance of vendors with security requirements
  </li>
  <li>
   Assist in finding technical gaps/weaknesses in BAFL environment through gap assessment exercise.
  </li>
  <li>
   Lead, and manage the IS GRC team in absence of Team Lead
  </li>
  <li>
   Manage risk acceptance process and ensure proper approval from the management
  </li>
  <li>
   Conduct cybersecurity awareness sessions bi-annually for employees to enhance their knowledge of security best practices, helping them recognize and prevent social engineering threats such as phishing, and promoting safer digital behavior
  </li>
  <li>
   Coordinate and manage regulatory inspections and ensure timely closure of observations
  </li>
 </ul>
 <p>
 </p>
</div>


Senior Manager Information Security

Search 10000+ Information security lead jobs near you this May. New roles added regularly across leading industries. Apply today.