Information Security Professional

The Information Security Professional is responsible for overseeing day-to-day security controls, reviews and analyses the security incidents and vulnerability reports produced by the dedicated SOC and Vulnerability Assessment (VA) teams, makes sure every risk has an owner and is closed, and produces the evidence that shows ZainTECH is secure and compliant.This role provides the CISO Office review and analysis of their output and drives follow-up actions to closure.

Responsibilities:

Security Incident Review and Analysis

• Review incident reports and tickets raised by the SOC, ensuring appropriate classification, severity assessment, and handling in accordance with incident response policies and playbooks.
• Assess business impact, affected assets and data, and root causes, escalating significant incidents to the Senior Information Security Professional and CISO.
• Coordinate with IT Operations and system owners to follow up on agreed containment, recovery, and corrective actions, ensuring timely implementation and closure.
• Analyse incident trends and recurring patterns, recommending improvements to security controls, detection use cases, and SOC playbooks.
• Contribute to post-incident reviews and maintain the CISO Office incident register.

Vulnerability Management and Assessment

• Review vulnerability assessment reports and scanning results from the VA team, ensuring appropriate coverage of endpoints, servers, network devices, applications, and cloud workloads.
• Analyse and prioritise vulnerability findings based on risk, asset criticality, exploitability, and available threat intelligence.
• Coordinate with asset owners to assign remediation activities, monitor progress against agreed timelines, and report overdue remediation items.
• Review penetration testing reports, validate the implementation of agreed remediation measures, and document risk exceptions where remediation is not feasible.

Identity, Endpoint, Cloud, and Infrastructure Security

• Conduct periodic user access reviews for critical applications, privileged accounts, and third-party access, identifying gaps in privileged access management and multi-factor authentication coverage.
• Verify endpoint protection, encryption, and security hardening baselines, and review firewall, VPN, IDS, and IPS rules and network segmentation against approved security standards.
• Review the security posture of Microsoft 365, Azure, AWS, and other cloud environments using Cloud Security Posture Management (CSPM) tools.
• Assess security requirements for new systems, application onboarding, and infrastructure changes through the Change Advisory process.
• Support the investigation and follow-up of Data Loss Prevention (DLP) alerts.

Governance, Risk, and Compliance

• Maintain assigned entries in the Information Security Risk Register and monitor the implementation of associated risk treatment plans.
• Collect, organise, and maintain security control evidence for ISO/IEC 27001 surveillance audits, internal audits, and client due diligence assessments.
• Support compliance with applicable regulatory frameworks, cybersecurity standards, and data protection laws across the organization's operating markets, including UAE Information Assurance Standards, Saudi NCA Essential Cybersecurity Controls, Kuwait CITRA requirements, Jordan Cybersecurity Law and Personal Data Protection Law, Egypt Personal Data Protection Law, India's Digital Personal Data Protection Act and CERT-In directions, and applicable UAE and KSA data protection regulations.
• Support security assessments of suppliers and business partners, ensuring appropriate security requirements and controls are evaluated.
• Prepare and coordinate responses to client and partner security questionnaires and due diligence requests.

Data Privacy and Protection

• Support the development and maintenance of the Record of Processing Activities (ROPA) in coordination with process owners, documenting processing purposes, data categories, data subjects, legal bases, retention periods, recipients, and systems.
• Support Privacy Impact Assessments (PIA) and Data Protection Impact Assessments (DPIA) for new or modified processing activities, systems, and suppliers, tracking agreed privacy controls through implementation.
• Maintain data inventories and data flow maps, including cross-border data transfers, ensuring alignment with the ROPA.
• Review the implementation of data protection controls, including data classification, minimisation, retention and disposal, consent management, access controls, and encryption.
• Support the handling of data subject rights requests, including access, correction, and deletion requests, ensuring compliance with applicable regulatory timelines.
• Coordinate with Legal and Data Protection teams to assess personal data breaches and gather relevant information for regulatory and individual notifications.
• Conduct privacy reviews of suppliers processing personal data, including reviewing data processing agreements and cross-border data transfer safeguards.

Business Impact Analysis and Business Continuity

• Conduct Business Impact Analysis (BIA) workshops and interviews with business units to identify critical services, processes, supporting systems, and their dependencies on people, technology, and suppliers.
• Assess the potential impact of business disruptions over time and recommend Maximum Tolerable Period of Disruption (MTPD), Recovery Time Objectives (RTO), and Recovery Point Objectives (RPO) for critical services.
• Develop and maintain business continuity plans and recovery procedures for critical services in coordination with process owners, in alignment with ISO 22301.
• Support business continuity exercises and disaster recovery testing, document outcomes, and track improvement actions through to closure.

Security Awareness

• Conduct phishing simulation campaigns and analyse results, providing reports and insights by business unit.
• Develop and deliver information security awareness content and short training sessions in English and Arabic, where applicable.
• Respond to employee information security queries through the designated security service desk channel.

Our Culture & Code of Conduct: At ZainTECH, we take pride in a culture built on collaboration, innovation, and uncompromising integrity. We are looking for individuals who share these values and are committed to customer-centricity and ethical excellence. All employees are expected to uphold our Code of Conduct, which serves as a guiding framework for responsible behavior across everything we do - from how we work with each other to how we engage with clients and partners globally.

Requirements

• 2 to 4 years of experience in information security, IT security, SOC, or a related technical role, including reading and analysing security incident and vulnerability assessment reports.
• Familiarity with ISO/IEC 27001:2022, NIST CSF 2.0, CIS Controls, and ITIL
• incident and change management.
• Working knowledge of data privacy and protection principles and controls, and of the personal data protection laws in ZainTECH's markets.
• Understanding of business impact analysis and business continuity concepts, including RTO and RPO.
• Experience in the GCC or wider Middle East region, or in a telecom or technology organisation
• Fluency in English and Arabic is mandatory.
• Bachelor's degree in information security, computer science, information technology, or a related field.
• At least one of CompTIA Security+, CompTIA CySA+, EC-Council CEH, GIAC, GSEC, or Microsoft SC-200.
• Cloud security certifications such as AZ-500 or AWS Security Specialty, and network certifications such as Cisco CCNA, Fortinet NSE, or Palo Alto PCNSA.

• ITIL Foundation certification, ISO 22301 Foundation or Lead Implementer, or a privacy certification such as IAPP CIPT or ISACA CDPSE.