Senior Information Security Professional

The Senior Information Security Professional acts as the technical authority within the CISO Office, providing independent oversight and in-depth analysis of security incidents and vulnerability assessment reports produced by the dedicated Security Operations Centre (SOC) and Vulnerability Assessment (VA) teams. The role drives cloud security initiatives, information security risk management, and regulatory compliance programmes, while providing technical guidance and mentorship to Information Security Professionals.

Working closely with the CISO, SOC, VA, IT Operations, Legal, Data Protection, and business stakeholders, the role ensures that security risks are appropriately assessed, prioritised, and addressed, and that ZainTECH maintains a strong and continuously improving security posture. This role provides the CISO with independent expert oversight of their outputs and a clear, risk-based assessment of the organization's overall security posture.

Responsibilities:

Security Incident Oversight and Analysis

• Review and analyse major and complex security incidents reported by the SOC, providing the CISO with independent assessments of business impact, root causes, and residual risks.
• Represent the CISO Office in major incident response calls, providing advice on business impact, regulatory notification requirements, and stakeholder communications.
• Maintain and oversee the Incident Response Policy, ensuring its effectiveness through tabletop exercises conducted at least twice annually in collaboration with the SOC, IT, Legal, Communications, and leadership teams.
• Monitor SOC performance against agreed Service Level Agreements (SLAs) and assess security detection coverage against the MITRE ATT&CK framework in coordination with the SOC team.
• Analyse security incident trends and relevant threat intelligence across the telecommunications, technology, and government sectors, recommending improvements to security controls and response capabilities.

Vulnerability Management and Oversight

• Define and maintain the Vulnerability Management Policy, including remediation SLAs, risk-based prioritisation criteria, and vulnerability exception handling procedures.
• Review and critically assess vulnerability assessment and penetration testing reports, challenging findings where necessary and validating the scope and coverage of critical assets.
• Coordinate with asset owners to establish remediation priorities and escalate overdue critical and high-risk vulnerabilities to leadership.
• Evaluate and recommend risk exceptions where remediation is not feasible, ensuring appropriate risk assessment and approval.
• Analyse external attack surface assessments covering domains, certificates, leaked credentials, and shadow IT to identify and address potential security exposures.

Security Architecture and Cloud Security

• Review security architecture and designs for new applications, cloud services, integrations, and AI solutions prior to implementation and go-live.
• Define and maintain security hardening baselines for endpoints, servers, network devices, and cloud environments.
• Lead cloud security posture management across Microsoft 365, Azure, AWS, and other cloud platforms used by the organisation.
• Provide technical guidance on identity architecture, Zero Trust principles, privileged access management, and Data Loss Prevention (DLP) controls.

Governance, Risk, and Compliance

• Lead information security risk assessments and maintain the Information Security Risk Register, ensuring clear risk ownership, treatment plans, and remediation tracking.
• Coordinate ISO/IEC 27001 certification and surveillance audits, internal audits, and the remediation of identified nonconformities.
• Develop and maintain regulatory control matrices and oversee compliance with applicable cybersecurity and data protection requirements across ZainTECH's operating markets and delivery locations, including UAE Information Assurance Standards and Cyber Security Council guidance, Saudi NCA Essential Cybersecurity Controls (ECC) and Critical Systems Cybersecurity Controls (CCC), Kuwait CITRA requirements, Jordan Cybersecurity Law and Personal Data Protection Law, Egypt Personal Data Protection Law, India's Digital Personal Data Protection Act and CERT-In directions, and applicable UAE and KSA data protection regulations.
• Develop, review, and maintain information security policies, standards, and procedures, ensuring effective governance and management of policy exceptions.
• Lead security assessments of critical suppliers and third-party service providers, coordinate responses to client due diligence questionnaires, and support SOC 2 and other assurance reporting requirements where applicable.

Data Privacy and Protection

• Lead the development and maintenance of the Record of Processing Activities (ROPA) across business units in coordination with the Data Protection function, ensuring periodic reviews at least annually and following significant changes.
• Lead and review Privacy Impact Assessments (PIA) and Data Protection Impact Assessments (DPIA) for high-risk processing activities, new systems, AI use cases, and suppliers, recommending appropriate controls to mitigate privacy risks.
• Embed Privacy by Design and Privacy by Default principles into security architecture reviews, change approval processes, and supplier onboarding activities.
• Define data protection standards covering data classification, handling, retention, and disposal, alongside security controls for protecting personal data, including encryption, masking, pseudonymisation, and Data Loss Prevention (DLP).
• Assess cross-border data transfers against applicable regulatory requirements and recommend appropriate safeguards, including contractual clauses and Transfer Impact Assessments.
• Oversee data subject rights processes in coordination with Legal and Data Protection, ensuring requests are handled within applicable regulatory timelines.
• Lead the security aspects of personal data breach assessments and support regulatory and individual notifications within the timelines established by applicable data protection laws.
• Monitor privacy control compliance, report identified gaps and remediation actions to the CISO and Data Protection function, and contribute to privacy awareness and training initiatives.

Business Impact Analysis and Business Continuity

• Lead the annual Business Impact Analysis (BIA) across business units to identify critical services, processes, systems, and their dependencies on people, technology, and suppliers, presenting findings to the CISO and leadership.
• Establish and agree on Maximum Tolerable Period of Disruption (MTPD), Recovery Time Objectives (RTO), and Recovery Point Objectives (RPO) for critical services in coordination with service owners, ensuring IT recovery capabilities meet defined objectives.
• Develop the business continuity strategy, policies, and plans in alignment with ISO 22301, including crisis management, cyber incident recovery, and communication procedures.
• Plan and lead business continuity exercises and disaster recovery tests, document outcomes, and drive identified improvement actions through to closure.
• Review and update business impact analyses and continuity plans following significant organisational, system, or supplier changes.

Reporting, Continuous Improvement, and Mentoring

• Prepare monthly information security posture and risk dashboards and contribute to quarterly CISO reporting, providing leadership with clear visibility of security performance and exposure.
• Define and monitor security Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs), identify opportunities for automation, and support business cases and vendor selection for new security technologies.
• Mentor and review the work of Information Security Professionals, providing structured coaching and guidance to strengthen team capabilities and technical expertise.
• Lead the organisation's security awareness programme, including phishing simulation strategies and targeted security training for high-risk roles.
• Act on behalf of the CISO in operational security matters when delegated.

Decision Authority

• Recommend changes to incident severity classifications and escalation of significant incidents to the CISO.
• Approve or reject security aspects of change requests within delegated authority.
• Recommend risk acceptance decisions and information security policy exceptions to the CISO.
• Direct vulnerability and audit finding remediation priorities.
• Recommend security tools, vendors, and service providers to support the organisation's information security objectives.

Requirements

• 6-9 years of information security experience within at least 8 years of overall ICT experience, including a minimum of 2 years in a senior or leadership role. Experience should include analysing major security incidents, overseeing vulnerability management and SOC service performance, and supporting ISO/IEC 27001 certification.
• Strong knowledge of ISO/IEC 27001:2022, NIST Cybersecurity Framework (CSF) 2.0, CIS Controls, and MITRE ATT&CK, with working knowledge of applicable regional cybersecurity and regulatory requirements.
• Strong understanding of data privacy principles, data protection controls, and applicable personal data protection laws across ZainTECH's operating markets and delivery locations.
• Demonstrated experience leading Business Impact Analysis (BIA) activities and developing business continuity plans.
• Experience working with GCC or wider Middle Eastern regulatory authorities, preferably within the telecommunications, technology, or financial services sectors.
• Fluency in English and Arabic is mandatory.
• Bachelor's degree in Information Security, Computer Science, Information Technology, or a related field.
• At least one valid professional certification from CISSP, CISM, GIAC GCIH, GIAC GCIA, or OSCP.
• Additional professional certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, or CRISC.
• Cloud security certifications such as CCSP, Microsoft Azure Security Engineer Associate (AZ-500), or AWS Certified Security - Specialty.
• Business continuity certifications such as ISO 22301 Lead Implementer or Lead Auditor, or Certified Business Continuity Professional (CBCP).
• Data privacy certifications such as IAPP CIPP/E, CIPM, CIPT, or ISACA CDPSE.