information security risk manager

Nawy

<div>
 We are seeking an experienced GRC Lead to drive governance, risk, and compliance activities
 
 
 in Nawy. This role ensures that security risks are identified, assessed, and managed while
 
 
 maintaining compliance with relevant regulatory and industry standards.
 
 
 The GRC lead leads the risk governance initiatives, oversees audits, develops policies,
 
 
 manages security awareness, and partners closely with engineering, product, and legal teams
 
 
 to ensure secure-by-design operations across the entire organization.
 
 
 
 Responsibilities
 
 
 
 <ul>
 <li>
 Maintain an enterprise-wide information security governance &amp; ISMS framework that
 
 
 </li>
 </ul>
 aligns with business objectives, regulatory requirements, and industry best practices.
 
 
 <ul>
 <li>
 Develop, maintain, and enforce security policies, standards, and procedures
 </li>
 <li>
 Lead strategic planning initiatives for security risk management, ensuring alignment
 
 
 </li>
 </ul>
 with ISO 27001 requirements.
 
 
 <ul>
 <li>
 Design, implement, and manage a security risk management framework that includes
 
 
 </li>
 </ul>
 risk assessments, control evaluations, and mitigation strategies.
 
 
 <ul>
 <li>
 Oversee and continuously improve the processes for vendor security risk assessments,
 
 
 </li>
 </ul>
 ensuring third-party risks are effectively managed.
 
 
 <ul>
 <li>
 Develop and monitor key risk indicators (KRIs) and performance metrics to evaluate the
 
 
 </li>
 </ul>
 effectiveness of security controls and risk mitigation efforts.
 
 
 <ul>
 <li>
 Oversee the development, implementation, and ongoing management of the
 
 
 </li>
 </ul>
 organization's security policies.
 
 
 <ul>
 <li>
 Prepare and lead the organization's readiness for external and internal security audits,
 
 
 </li>
 </ul>
 including ISO 27001 certification audits.
 
 
 <ul>
 <li>
 Build and run security awareness and phishing simulation programs and promote an
 
 
 </li>
 </ul>
 organization-wide culture of security accountability.
 
 
 <ul>
 <li>
 Ensure ongoing compliance with local regulatory frameworks, including those issued by
 
 
 </li>
 </ul>
 CBE, FRA, and related bodies.
 
 
 
 Requirements
 
 
 
 <ul>
 <li>
 At least 4 years of experience in GRC, information security risk management or security
 
 
 </li>
 </ul>
 compliance roles.
 
 
 <ul>
 <li>
 Certifications: Relevant certifications such as CISSP, CISM, CRISC, or CISA are
 
 
 </li>
 </ul>
 preferred.
 
 
 <ul>
 <li>
 Demonstrated experience with ISO 27001 implementation, security audits, and vendor
 
 
 </li>
 </ul>
 security risk assessments.
 
 
 <ul>
 <li>
 Solid understanding of cloud architectures and security controls across AWS and
 
 
 </li>
 </ul>
 Google Cloud Platform (GCP).
 
 
 <ul>
 <li>
 Familiarity with regulatory requirements in Egypt and international data protection
 
 
 </li>
 </ul>
 laws.
 
 
 <ul>
 <li>
 University/college degree in a relevant professional field
 </li>
 <li>
 Excellent communication skills in English, both written and spoken
 </li>
 </ul>
</div>

Cyber Security GRC Lead

Nawy Real Estate

<div>We are seeking an experienced GRC Lead to drive governance, risk, and compliance activities
in Nawy. This role ensures that security risks are identified, assessed, and managed while
maintaining compliance with relevant regulatory and industry standards.
The GRC lead leads the risk governance initiatives, oversees audits, develops policies,
manages security awareness, and partners closely with engineering, product, and legal teams
to ensure secure-by-design operations across the entire organization.
Responsibilities<ul><li>Maintain an enterprise-wide information security governance &amp; ISMS framework that</li></ul>
aligns with business objectives, regulatory requirements, and industry best practices.<ul><li>Develop, maintain, and enforce security policies, standards, and procedures.</li><li>Lead strategic planning initiatives for security risk management, ensuring alignment</li></ul>
with ISO 27001 requirements.<ul><li>Design, implement, and manage a security risk management framework that includes</li></ul>
risk assessments, control evaluations, and mitigation strategies.<ul><li>Oversee and continuously improve the processes for vendor security risk assessments,</li></ul>
ensuring third-party risks are effectively managed.<ul><li>Develop and monitor key risk indicators (KRIs) and performance metrics to evaluate the</li></ul>
effectiveness of security controls and risk mitigation efforts.<ul><li>Oversee the development, implementation, and ongoing management of the</li></ul>
organization&rsquo;s security policies.<ul><li>Prepare and lead the organization&rsquo;s readiness for external and internal security audits,</li></ul>
including ISO 27001 certification audits.<ul><li>Build and run security awareness and phishing simulation programs and promote an</li></ul>
organization-wide culture of security accountability.<ul><li>Ensure ongoing compliance with local regulatory frameworks, including those issued by</li></ul>
CBE, FRA, and related bodies. 
Requirements<ul><li> 
At least 4 years of experience in GRC, information security risk management or security</li></ul>
compliance roles.<ul><li>Certifications: Relevant certifications such as CISSP, CISM, CRISC, or CISA are</li></ul>
preferred.<ul><li>Demonstrated experience with ISO 27001 implementation, security audits, and vendor</li></ul>
security risk assessments.<ul><li>Solid understanding of cloud architectures and security controls across AWS and</li></ul>
Google Cloud Platform (GCP).<ul><li>Familiarity with regulatory requirements in Egypt and international data protection</li></ul>
laws.<ul><li>University/college degree in a relevant professional field.</li><li>Excellent communication skills in English, both written and spoken.</li></ul></div>

Bank Alfalah Limited

<div>
 
 Job Purpose:
 
 
 The Governance, Risk &amp; Compliance Manager is responsible for establishing, managing, and continuously improving the organization&rsquo;s information security governance, risk management, and compliance framework. The role ensures alignment with regulatory requirements, industry standards, and business objectives, while providing strategic oversight, leadership, and assurance to senior management
 
 
 
 
 
 Responsibilities:
 
 <ul>
 <li>
 Support the execution of internal and external information security audits in collaboration with the Team lead.
 </li>
 <li>
 Interpret and implement regulatory requirements and liaise with internal teams to ensure compliance.
 </li>
 <li>
 Facilitate coordination between business and technical teams to conduct comprehensive security reviews.
 </li>
 <li>
 Work with stakeholders to recommend and track risk mitigation measures, ensuring timely closure of identified gaps/observations.
 </li>
 <li>
 Maintain and oversee the information security risk register.
 </li>
 <li>
 Define and maintain risk management framework including risk assessment methodology and risk appetite alignment
 </li>
 <li>
 Coordinate with IT/security teams for mitigation strategies.
 </li>
 <li>
 Assist TL in preparation of reports/presentations for management reporting and ITSC/BITC.
 </li>
 <li>
 Lead and support the development, implementation, and continuous improvement of information security policies, procedures, and governance frameworks to ensure alignment with industry standards and regulatory requirements.
 </li>
 <li>
 Define and monitor KPIs/KRIs to measure effectiveness of security controls and risk posture
 </li>
 <li>
 Ensure organizational policies, processes, and operations achieve full compliance with SBP regulatory requirements, while maintaining alignment with cross‑border regulations.
 </li>
 <li>
 Oversee cyber security and information security (NESA Compliance) programs.
 </li>
 <li>
 Lead risk assessments and ensure compliance of vendors with security requirements
 </li>
 <li>
 Assist in finding technical gaps/weaknesses in BAFL environment through gap assessment exercise.
 </li>
 <li>
 Lead, and manage the IS GRC team in absence of Team Lead
 </li>
 <li>
 Manage risk acceptance process and ensure proper approval from the management
 </li>
 <li>
 Conduct cybersecurity awareness sessions bi-annually for employees to enhance their knowledge of security best practices, helping them recognize and prevent social engineering threats such as phishing, and promoting safer digital behavior
 </li>
 <li>
 Coordinate and manage regulatory inspections and ensure timely closure of observations
 </li>
 </ul>
 
 
</div>

Senior Manager Information Security

The Home Depot

<div><div>Position Purpose:<div>
The Cybersecurity Security Analyst is responsible for protecting the organization&rsquo;s information assets by identifying, assessing, and helping remediate security risks across business portfolios. This role requires a strong cybersecurity mindset, solid risk management skills, and the ability to build relationships with business and technology stakeholders to drive security initiatives. The ideal candidate is customer-focused, detail-oriented, and highly skilled in Excel and documentation to support data-driven decision making and clear communication.</div><div></div>
Key Responsibilities:<ul><li><div><ul><li>
Manage identified cybersecurity risks through established risk management tools and processes spanning applications, infrastructure, and business operations.</li></ul></div><div><ul><li>
Collaborate with product, engineering, and business teams to advance security initiatives and integrate security requirements into proposed solutions.</li></ul></div><div><ul><li>
Prepare and deliver the weekly report on security vulnerabilities and identified risks to the business and stakeholders, ensuring timely remediation efforts.</li></ul></div><div><ul><li>
Monitor, analyze, and report on key security metrics, issues, and remediation activities utilizing Excel and other relevant reporting platforms.</li></ul></div><div><ul><li>
Support the organization&rsquo;s migration to &quot;Secure Flow&quot; (paved path) in partnership with Cybersecurity, IT Developers, and business stakeholders.</li></ul></div><div><ul><li>
Promote awareness of security policies, standards, procedures, and playbooks among business partners to ensure comprehensive adherence from project initiation.</li></ul></div><div><ul><li>
Investigate findings and exceptions, coordinating resolution efforts with Cybersecurity, IT Developers, and business stakeholders.</li></ul></div><div><ul><li>
Assist with third-party/vendor security assessments and risk reviews as required.</li></ul></div><div><ul><li>
Provide customer-focused assistance to internal partners by clearly communicating security requirements, associated risks, and recommended actions in an accessible and business-oriented manner.</li></ul></div>
30% Analysis - Perform data gathering, synthesis, and develop solutions; Leverage department standards to achieve results</li><li>
30% Collaborate - Partner with teams to identify trends and resolve problems</li><li>
40% Drive Execution - Evaluate information and provide recommendations based on findings</li></ul> 
Direct Manager/Direct Reports:<ul><li>
This Position typically reports to Manager or Sr. Manager</li><li>
This Position has 0 Direct Reports</li></ul> 
Travel Requirements:<ul><li>
Typically requires overnight travel less than 10% of the time.</li></ul> 
Physical Requirements:<ul><li>
Most of the time is spent sitting in a comfortable position and there is frequent opportunity to move about. On rare occasions there may be a need to move or lift light articles.</li></ul> 
Working Conditions:<ul><li>
Located in a comfortable indoor area. Any unpleasant conditions would be infrequent and not objectionable.</li></ul> 
Minimum Qualifications:<ul><li>
Must be eighteen years of age or older.</li><li>
Must be legally permitted to work in the United States.</li></ul> 
Preferred Qualifications:<ul><li><div><div><ul><li>
2+ years of hands-on experience in cybersecurity, information security, or a closely related field.</li></ul></div><div><ul><li>
Demonstrated cybersecurity mindset with a strong understanding of core security principles (confidentiality, integrity, availability, least privilege, defense-in-depth, etc.).</li></ul></div></div><div><div><ul><li>
Experience with risk management practices, including identifying, assessing, and helping to prioritize and remediate security risks.</li></ul></div><div><ul><li>
Proven ability to build and maintain strong relationships with cross-functional stakeholders (business, product, engineering, operations).</li></ul></div><div><ul><li>
Strong customer focus mindset, with the ability to balance security needs with business objectives.</li></ul></div><div><ul><li>
Advanced proficiency in Microsoft Excel (e.g., pivot tables, lookups, charts, basic formulas) for analysis and reporting.</li></ul></div><div><ul><li>
Excellent documentation skills, including writing clear security reports, procedures, and stakeholder communications.</li></ul></div><div><ul><li>
Strong analytical, problem-solving, and organizational skills.</li></ul></div><div><ul><li>
Effective verbal and written communication skills, with the ability to explain technical issues to non-technical audiences.</li></ul></div><div><ul><li> 
CompTIA Security+ certification or equivalent industry-recognized security certification.</li></ul></div><div><ul><li>
Experience working in or with large enterprise environments and complex business portfolios.</li></ul></div></div>
No additional qualifications</li></ul> 
Minimum Education:<ul><li>
The knowledge, skills and abilities typically acquired through the completion of a bachelor's degree program or equivalent degree in a field of study related to the job.</li></ul> 
Preferred Education:<ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Information Security, Computer Science, Information Technology, or related field; or equivalent work experience.</li></ul> 
Minimum Years of Work Experience:<ul><li>
0</li></ul> 
Preferred Years of Work Experience:<ul><li>
No additional years of experience</li></ul> 
Minimum Leadership Experience:<ul><li>
None</li></ul> 
Preferred Leadership Experience:<ul><li>
None</li></ul> 
Certifications:<ul><li>
None</li></ul> 
Competencies:<ul><li>
Action Oriented</li><li>
Collaborates</li><li>
Communicates Effectively</li><li>
Customer Focus</li><li>
Drives Results</li></ul></div> 
Apply End Date: 05/12/2026</div>

Cybersecurity Analyst - SSE

Stellar Hunters

<div><h4 class="jobSectionHeader">Job Summary</h4>
We are seeking a Cyber GRC Manager to lead and mature the company&rsquo;s cyber governance, risk, and compliance (GRC) program. The successful candidate will partner with Security, IT, Legal, Risk, and business stakeholders to design, implement, and operate controls, policies, and risk management practices that reduce cyber risk and support business objectives. This role will own compliance initiatives, third-party risk assessments, policy lifecycle management, and metrics to drive continuous improvement across the organization.<h4 class="jobSectionHeader">
Key Responsibilities</h4><h5 class="jobSectionHeader">
GRC Strategy &amp; Program Leadership</h5><ul><li>
Develop and evolve a risk-based cyber GRC strategy that aligns with enterprise risk appetite and business priorities.</li><li>
Lead the GRC program, including governance forums, risk assessment cadence, control frameworks, and remediation tracking.</li><li>
Partner with senior leadership to translate regulatory and business requirements into practical program objectives and roadmaps.</li></ul><h5 class="jobSectionHeader">
Policy, Standards &amp; Control Management</h5><ul><li>
Maintain and enhance information security policies, standards, and procedures; ensure clear ownership and version control across the policy lifecycle.</li><li>
Define and maintain control objectives mapped to frameworks (e.g., NIST CSF, ISO 27001, SOC 2) and ensure consistent implementation across teams.</li><li>
Coordinate control testing, assessments, and remediation activities with internal teams and external assessors.</li></ul><h5 class="jobSectionHeader">
Risk Assessment &amp; Third-Party Risk Management</h5><ul><li>
Conduct enterprise and technology risk assessments; identify, evaluate, and prioritize cyber risks and mitigation plans.</li><li>
Own third-party risk management processes including vendor risk assessments, due diligence, contract security requirements, and ongoing monitoring.</li><li>
Work with procurement and vendor owners to remediate deficiencies and reduce supply chain risk.</li></ul><h5 class="jobSectionHeader">
Compliance &amp; Audit Support</h5><ul><li>
Manage compliance programs and readiness for relevant regulations and standards (e.g., SOC 2, ISO 27001, GDPR, HIPAA where applicable).</li><li>
Act as primary liaison for internal and external audits, prepare evidence and reporting, and coordinate remediation activities.</li><li>
Maintain documentation and continuous evidence of controls to support attestations and regulatory reporting.</li></ul><h5 class="jobSectionHeader">
Metrics, Reporting &amp; Continuous Improvement</h5><ul><li>
Define and report GRC metrics and dashboards (e.g., risk posture, control maturity, remediation timelines, vendor risk status) to leadership and stakeholders.</li><li>
Use data and trend analysis to identify program gaps, recommend improvements, and measure the effectiveness of risk reduction efforts.</li><li>
Develop and maintain GRC playbooks, runbooks, and process documentation to enable repeatable, auditable practices.</li></ul><h4 class="jobSectionHeader">
Required Qualifications - Skills &amp; Experience</h4><ul><li>
Bachelor&rsquo;s degree in Information Security, Cybersecurity, IT, Risk Management, or a related field, or equivalent practical experience.</li><li>
5+ years of hands-on experience in cyber governance, risk, and compliance, information security, or related roles.</li><li>
Practical knowledge of common security frameworks and standards (e.g., NIST CSF, ISO 27001, SOC 2) and experience mapping controls to frameworks.</li><li>
Experience managing third-party/vendor risk assessments, contract security requirements, and remediation workflows.</li><li>
Strong communication and stakeholder management skills with the ability to influence technical and non-technical audiences.</li><li>
Analytical mindset with experience developing risk assessments, metrics, and executive-level reporting.</li><li>
Familiarity with GRC platforms, risk assessment tools, ticketing systems, and common productivity software.</li></ul><h4 class="jobSectionHeader">
Preferred Qualifications</h4><ul><li>
Relevant certifications such as CISSP, CISM, CRISC, CISA, or CDPSE preferred.</li><li>
Experience supporting SOC 2, ISO 27001, or other third-party audits and working with external assessors.</li><li>
Background in cloud security, identity and access management, or secure software development lifecycle practices.</li><li>
Experience implementing or operating GRC tooling (e.g., Archer, RiskLens, OneTrust, ServiceNow GRC) is a plus.</li></ul><h4 class="jobSectionHeader">
Work Environment &amp; Compensation</h4><ul><li>
Full-time position with a hybrid onsite/remote model; occasional travel and after-hours engagement may be required to support assessments and incident response activities.</li><li>
Competitive salary commensurate with experience and a comprehensive benefits package, including health insurance, retirement plan options, and paid time off.</li><li>
Opportunities for professional development, cross-functional collaboration, and career growth within Security, IT, and Risk functions.</li><li>
Inclusive, respectful culture that values diversity, equity, and work-life balance.</li></ul></div>

Cyber GRC Manager

U.S. Bank

<div>At U.S. Bank, we&rsquo;re on a journey to do our best. Helping the customers and businesses we serve to make better and smarter financial decisions and enabling the communities we support to grow and succeed. We believe it takes all of us to bring our shared ambition to life, and each person is unique in their potential. A career with U.S. Bank gives you a wide, ever-growing range of opportunities to discover what makes you thrive at every stage of your career. Try new things, learn new skills and discover what you excel at&mdash;all from Day One.<h2 class="jobSectionHeader">
Job Description</h2><div>
U.S. Bank is seeking an Operational Risk Review (ORR) Technology Manager (&quot;Manager&quot;) responsible for leading a team of Lead Analyst(s) and Analyst(s) (collectively &ldquo;Analysts&rdquo;) in the administration and execution of review activities within Independent Risk Review and Assessment (IRRA), a centralized second line of defense independent review function. This role offers an exciting opportunity to drive the continued growth, enhancement, and delivery of IRRA&rsquo;s ORR program. 
 
ORR provides risk-based review and effective challenge of the Company's operational risk (inclusive of technology risk), and operational risk-related processes and controls associated with the products and services offered across all business lines and enabling functions. Based on the Company's enterprise risk taxonomy, in-scope operational risk categories include: Fraud, Operations, People, Security of Physical Assets, Third Party, Business Resiliency, Systems, Cyber/Information Security, Legal, Model, Conduct, Data Management, and Fiduciary. Objective risk mitigation, process, and control review activities include planning and scoping, design and execution, reporting and rating, and Issue creation and validation. 
 
Key roles and responsibilities of the ORR Technology Manager include working with business lines and other Risk, Compliance, and Audit professionals across the Company to evaluate processes and controls to ensure an effective risk management framework. The ORR Technology Manager is responsible for directly managing a team of Lead Analyst(s) and Analyst(s), including overseeing review activities, timely completion of planned reviews, conducting performance management, and overall staff development. The Manager leads and oversees projects and activities to confirm compliance with internal policies, industry standards, and applicable laws and regulations related to technology, business resiliency, data governance, cyber, systems, artificial intelligence (AI), and information security. Through review performance, the Manager is responsible for the identification of gaps, weaknesses, and risk exposures within the control and process environment. If gaps are identified, the Manager will partner with the business line and Risk Management groups to recommend and influence solutions to mitigate operational risks. The Manager is responsible will deliver effective verbal and written communication of review results to the ORR Senior Manager, including draft Issues and Reports, and will respond to and/or escalation of significant risks, as appropriate.<div>
Basic Qualifications 
<ul><li>Bachelor's degree, or equivalent work experience</li><li>Typically more than 10 years of applicable experience</li></ul></div>
Preferred Skills/Experience<ul><li>Proven leadership skills.</li><li>Subject Matter Expert or advanced knowledge of technology, business resiliency, systems, data governance, cyber, and information security risks as well as industry trends that impact Bank operations.</li><li>Thorough understanding of risk management standards, the common definition of internal controls, and how control frameworks are designed and operate to mitigate risks.</li><li>Deep understanding of the business line&rsquo;s operations, products, services, systems, and associated risks.</li><li>Deep business acumen and credibility to help business line(s) proactively identify risks and address changing risk landscape.</li><li>Superb process facilitation, project management, and analytical skills with the ability to manage multiple tasks and deadlines simultaneously.</li><li>Excellent presentation, interpersonal, written and verbal communication skills.</li><li>Proficient computer navigation skills using a variety of software packages, including Microsoft Office applications and word processing, spreadsheets, databases, and presentations.</li><li>Applicable professional certifications (e.g., CISA, GSNA, CISSP, CRISC, CIA, etc.) are preferred.</li></ul>
This role requires working from a U.S. Bank location three (3) or more days per week.</div>
If there&rsquo;s anything we can do to accommodate a disability during any portion of the application or hiring process, please refer to our disability accommodations for applicants.
Benefits:
Our approach to benefits and total rewards considers our team members&rsquo; whole selves and what may be needed to thrive in and outside work. That's why our benefits are designed to help you and your family boost your health, protect your financial security and give you peace of mind. Our benefits include the following:<ul><li>
Healthcare (medical, dental, vision)</li><li>
Basic term and optional term life insurance</li><li>
Short-term and long-term disability</li><li>
Pregnancy disability and parental leave</li><li>
401(k) and employer-funded retirement plan</li><li>
Paid vacation (from two to five weeks depending on salary grade and tenure)</li><li>
Up to 11 paid holiday opportunities</li><li>
Adoption assistance</li><li>
Sick and Safe Leave accruals of one hour for every 30 worked, up to 80 hours per calendar year unless otherwise provided by law</li></ul>
Review our full benefits available by employment status here.
U.S. Bank is an equal opportunity employer. We consider all qualified applicants without regard to race, religion, color, sex, national origin, age, sexual orientation, gender identity, disability or veteran status, and other factors protected under applicable law.
E-Verify
U.S. Bank participates in the U.S. Department of Homeland Security E-Verify program in all facilities located in the United States and certain U.S. territories. The E-Verify program is an Internet-based employment eligibility verification system operated by the U.S. Citizenship and Immigration Services.
The salary range reflects figures based on the primary location, which is listed first. The actual range for the role may differ based on the location of the role. In addition to salary, U.S. Bank offers a comprehensive benefits package, including incentive and recognition programs, equity stock purchase 401(k) contribution and pension (all benefits are subject to eligibility requirements). Pay Range: $133,365.00 - $156,900.00
U.S. Bank will consider qualified applicants with arrest or conviction records for employment. U.S. Bank conducts background checks consistent with applicable local laws, including the Los Angeles County Fair Chance Ordinance and the California Fair Chance Act as well as the San Francisco Fair Chance Ordinance. U.S. Bank is subject to, and conducts background checks consistent with the requirements of Section 19 of the Federal Deposit Insurance Act (FDIA). In addition, certain positions may also be subject to the requirements of FINRA, NMLS registration, Reg Z, Reg G, OFAC, the NFA, the FCPA, the Bank Secrecy Act, the SAFE Act, and/or federal guidelines applicable to an agreement, such as those related to ethics, safety, or operational procedures.
Applicants must be able to comply with U.S. Bank policies and procedures including the Code of Ethics and Business Conduct and related workplace conduct and safety policies.
Posting may be closed earlier due to high volume of applicants.</div>

Operational Risk Review Manager - Technology

Aldar Academies

<div>Aldar Education is currently seeking a UAE National Manager &ndash; Information Security for an immediate start in Abu Dhabi to support our growing family of owned and operated schools in the UAE. This is an exciting opportunity to join the highly successful Aldar family of schools and to help shape the future of Abu Dhabi&rsquo;s leading school group.
This position is responsible for implementing Information Security across Aldar Education, ensuring the effective implementation of security programmes, day-to-day cyber security operations, and implementing long-term security strategy across all HQ and school environments. The Manager will work closely with the Senior Manager and IT Infrastructure team to embed security controls at every layer of the technology estate, and liaison with the Group InfoSec team and internal teams to align governance, policies, and enterprise-wide security standards. The role leads the organisation's response to cyber threats, drives a culture of security awareness, and ensures Aldar Education's posture is continuously strengthened in line with modern cyber security practices.
Since its inception in 2007 with just 250 students, Aldar Education has grown into a highly sought-after education provider, with more than 25 owned and managed premium and super-premium schools and academies- in partnership with some of the world&rsquo;s most prestigious institutions including Rugby School, King&rsquo;s College Wimbledon, and Cranleigh. The Group now serves over 38,000 students through 5,000 educators from more than 100 nationalities to deliver world-class education across a broad range of curricula and learning pathways from nursery through to K12.
At Aldar Education, our impact goes far beyond the classroom: we are proud to contribute to the UAE&rsquo;s vision for a sustainable, knowledge-based economy through premium education. With this in mind, we hire educators and industry professionals who not only embody our values and cultural ethos but also bring a genuine passion for education&mdash;qualities central to our mission of shaping the leaders of tomorrow.
If you are passionate about excellence and ready to make a meaningful impact, we invite you to apply and be part of our journey.</div>
 <div>Minimum Qualifications
<ul><li>Bachelor's degree in Computer Science, Information Security, Cybersecurity, or a related discipline.
</li><li>ISO/IEC 27001 Lead Implementer or Lead Auditor certification (required).
</li><li>CISSP (Certified Information Systems Security Professional) or CISM (Certified Information Security Manager) &mdash; required or strongly preferred.
</li><li>Cloud security certification such as CCSP, Microsoft AZ-500 (Azure Security Engineer), or equivalent (preferred).
</li><li>CRISC (Certified in Risk and Information Systems Control) or equivalent risk certification (advantageous).
</li></ul>Minimum Experience
<ul><li>Minimum 5 years' experience in Information Security or Cybersecurity roles.
</li><li>Demonstrable experience managing security in a cloud-heavy environment (Microsoft 365 / Azure or equivalent).
</li><li>Proven experience with SOC operations, incident response, and threat intelligence programmes.
</li><li>Strong understanding of ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, and UAE data protection regulations (PDPL).
</li><li>Strong understanding of enterprise risk management frameworks.
</li></ul>Job Specific Knowledge &amp; Skills
Job Specific Knowledge:
<ul><li>Zero Trust Architecture principles and practical implementation across network, identity, and application tiers.
</li><li>Cloud Security Posture Management (CSPM) and Cloud Native Application Protection Platforms (CNAPP).
</li><li>Identity and Access Management (IAM) and Privileged Access Management (PAM) &mdash; e.g., Microsoft Entra ID, CyberArk, or equivalent.
</li><li>SIEM and SOAR platforms &mdash; correlation rule development, playbook automation, alert triage, and tuning.
</li><li>Extended Detection and Response (XDR) and Endpoint Detection and Response (EDR) platforms.
</li><li>Data Loss Prevention (DLP) and data classification policy design and enforcement.
</li><li>Web Application Firewall (WAF) management, tuning, and API security.
</li><li>Vulnerability Management &mdash; full VMDR lifecycle from discovery through remediation validation.
</li><li>Network security &mdash; next-generation firewalls, DNS security, micro-segmentation, and network access control.
</li><li>Threat intelligence platforms and practical application of the MITRE ATT&amp;CK framework.
</li><li>Security awareness programme design and phishing simulation platforms.
</li><li>Business Continuity and Disaster Recovery planning, testing, and improvement.
</li><li>Compliance and risk assessment aligned to ISO 27001, NIST, CIS, and UAE regulatory requirements.
</li><li>Secure-by-design and DevSecOps principles for integration into technology delivery lifecycles.
</li></ul>General Skills:
<ul><li>Strong analytical and critical thinking skills with the ability to assess complex risk scenarios.
</li><li>Excellent written and verbal communication &mdash; able to convey technical risk clearly to non-technical stakeholders.
</li><li>Strong interpersonal skills with the ability to influence and collaborate across teams and functions.
</li><li>Highly self-motivated with keen attention to detail and a continuous improvement mindset.
</li><li>Ability to prioritise and manage competing demands effectively in a high-pressure environment.
</li><li>Commercial awareness and the ability to balance security requirements with business and operational needs.
</li></ul>What We Offer:
Aldar Education is a family of world-class, child-centered, and innovative schools based in the UAE. We educate students across our group of owned and managed schools and as we grow, so does our need for highly skilled, inspirational, and dedicated school and educational leaders. We offer an attractive remuneration package including a range of benefits. Our future-focused learning model includes both students and staff, so we place a special emphasis on professional development, coaching, and training.
Successful candidates will have access to a wide network of professionals and opportunities to both lead and contribute to training others as well as developing themselves.
This job description is not all-inclusive. Aldar Education reserves the right to amend this job description at any time. We are an equal opportunity employer, committed to a diverse and inclusive work environment. We are dedicated to our national development strategy and encourage UAE Nationals in their application to our company.
Aldar Education is committed to safeguarding and promoting the welfare of children and young people and expects all staff to share this commitment. Offers of appointment are subject to satisfactory references and police clearance.</div>
 <div>Main Duties
<ul><li>Partner with teams to implement and maintain enterprise-wide information security governance, policies, and controls across all Aldar Education schools and HQ.
</li><li>Design and implement, and continuous improvement of a Zero Trust security architecture across network, identity, and application layers.
</li><li>Manage a comprehensive information security programme aligned to ISO/IEC 27001, NIST Cybersecurity Framework (CSF), CIS Controls, and applicable UAE data protection regulations including PDPL.
</li><li>Enforce and implement Identity and Access Management (IAM) and Privileged Access Management (PAM) controls to enforce least-privilege principles across all systems and platforms.
</li><li>Implement the organisation's cloud security posture, including security configurations for Microsoft 365, Azure, and other cloud platforms used across Aldar Education, leveraging CSPM and CNAPP tooling.
</li><li>Follow Incident Response lifecycle &mdash; detection, containment, eradication, recovery, and post-incident review &mdash; ensuring lessons learned are captured and controls are strengthened.
</li><li>Proactively support regular threat intelligence reviews, vulnerability assessments, and penetration testing to proactively identify and remediate risks across the environment.
</li><li>Maintain, regularly test, and improve Business Continuity and Disaster Recovery plans for all critical IT systems and data assets.
</li><li>Develop, enforce, and review data classification and Data Loss Prevention (DLP) policies to protect student, staff, and institutional data across all environments.
</li><li>Implement security awareness programme &mdash; including phishing simulation exercises &mdash; for all staff, contractors, and system users to build a security-conscious culture.
</li><li>Follow security-by-design and DevSecOps principles into all technology projects, system implementations, and application development lifecycles.
</li><li>Monitor emerging threats, vulnerabilities, attacker techniques (using MITRE ATT&amp;CK), and regulatory changes; advise leadership on appropriate and timely risk responses.
</li><li>Liaise with Operations, Infrastructure, and Application teams to ensure consistent application of security controls across all layers of the IT environment.
</li></ul>Specific Duties
<ul><li>Optimise the Darktrace AI-powered email and network security solution, including regular model tuning to reduce false positives and improve detection fidelity.
</li><li>Administer continuous vulnerability management, patch prioritisation, and web application security scanning across all environments.
</li><li>Manage the Extended Detection and Response (XDR) platform to correlate endpoint, identity, network, and cloud telemetry for unified, high-fidelity threat detection and response.
</li><li>Administer the Microsoft 365 Defender suite &mdash; including Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps &mdash; to protect the organisation's collaboration and productivity environment.
</li><li>Implement and maintain ISMS controls across server and network infrastructure, ensuring ongoing alignment with ISO/IEC 27001 certification requirements.
</li><li>Plan and coordinate IT security audits &mdash; both internal reviews and third-party assessments &mdash; to satisfy ISMS, regulatory, and Group requirements.
</li><li>Implement and manage a Cloud Access Security Broker (CASB) to enforce data security policies and monitor shadow IT across cloud services used by staff and students.
</li><li>Manage Web Application Firewall (WAF) and Bot Manager to protect web-facing applications and APIs from application-layer attacks and automated threats.
</li><li>Manage DNS ETP and EdgeDNS for secure DNS resolution, malicious domain filtering, and endpoint traffic protection.
</li><li>Oversee Mobile Device Management (MDM) security policies &mdash; including BYOD controls &mdash; for all student and staff devices across the estate.
</li><li>Coordinate and supervise approved vendors to perform VAPT and DR tests; review findings, prioritise and track remediation to closure.
</li><li>Manage cloud security posture for Azure and Microsoft 365 environments using Microsoft Secure Score, Defender for Cloud, and associated compliance dashboards.
</li><li>Coordinate with principal vendors for new security projects and the resolution of operational security issues, ensuring accountability and timely delivery.</li></ul></div>

Manager – Business Information Security (UAE National)

Search 10000+ Information security risk manager jobs near you this May. New roles added regularly across leading industries. Apply today.

10000 information security risk manager jobs Near Me

Cyber Security GRC Lead

Cyber Security GRC Lead

Senior Manager Information Security

Cybersecurity Analyst - SSE

Cyber GRC Manager

Operational Risk Review Manager - Technology

Manager – Business Information Security (UAE National)