{"id":4068722,"url":"https://alion.io/job/zaintech-senior-information-security-professional","title":"Senior Information Security Professional","company":{"id":5748,"name":"ZainTECH","domain":"zaintech.com","url":"https://alion.io/company/zaintech","size_band":null,"is_staffing_agency":false,"employer_type":"services","is_intermediary":false,"listed_via":null,"ats_vendor":"Workable","truth_index":{"grade":"A","score":95,"open_postings":8,"ghost_share":0,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":106,"computed_at":"2026-11-11T05:49:22Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Amman, Jordan"],"countries":["JO"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"DLP","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SOC 2","optional":false},{"name":"Zero Trust","optional":false}],"status":"live","first_seen_at":"2026-11-11T12:36:31Z","employer_posted_date":"2026-11-11","last_verified_at":"2026-11-11T17:35:32Z","board_verified":true,"closed_at":null,"days_open":0,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":0},"description":"The Senior Information Security Professional acts as the technical authority within the CISO Office, providing independent oversight and in-depth analysis of security incidents and vulnerability assessment reports produced by the dedicated Security Operations Centre (SOC) and Vulnerability Assessment (VA) teams. The role drives cloud security initiatives, information security risk management, and regulatory compliance programmes, while providing technical guidance and mentorship to Information Security Professionals.\nWorking closely with the CISO, SOC, VA, IT Operations, Legal, Data Protection, and business stakeholders, the role ensures that security risks are appropriately assessed, prioritised, and addressed, and that ZainTECH maintains a strong and continuously improving security posture. This role provides the CISO with independent expert oversight of their outputs and a clear, risk-based assessment of the organization's overall security posture.\nResponsibilities:\nSecurity Incident Oversight and Analysis\nReview and analyse major and complex security incidents reported by the SOC, providing the CISO with independent assessments of business impact, root causes, and residual risks.\nRepresent the CISO Office in major incident response calls, providing advice on business impact, regulatory notification requirements, and stakeholder communications.\nMaintain and oversee the Incident Response Policy, ensuring its effectiveness through tabletop exercises conducted at least twice annually in collaboration with the SOC, IT, Legal, Communications, and leadership teams.\nMonitor SOC performance against agreed Service Level Agreements (SLAs) and assess security detection coverage against the MITRE ATT&CK framework in coordination with the SOC team.\nAnalyse security incident trends and relevant threat intelligence across the telecommunications, technology, and government sectors, recommending improvements to security controls and response capabilities.\nVulnerability Management and Oversight\nDefine and maintain the Vulnerability Management Policy, including remediation SLAs, risk-based prioritisation criteria, and vulnerability exception handling procedures.\nReview and critically assess vulnerability assessment and penetration testing reports, challenging findings where necessary and validating the scope and coverage of critical assets.\nCoordinate with asset owners to establish remediation priorities and escalate overdue critical and high-risk vulnerabilities to leadership.\nEvaluate and recommend risk exceptions where remediation is not feasible, ensuring appropriate risk assessment and approval.\nAnalyse external attack surface assessments covering domains, certificates, leaked credentials, and shadow IT to identify and address potential security exposures.\nSecurity Architecture and Cloud Security\nReview security architecture and designs for new applications, cloud services, integrations, and AI solutions prior to implementation and go-live.\nDefine and maintain security hardening baselines for endpoints, servers, network devices, and cloud environments.\nLead cloud security posture management across Microsoft 365, Azure, AWS, and other cloud platforms used by the organisation.\nProvide technical guidance on identity architecture, Zero Trust principles, privileged access management, and Data Loss Prevention (DLP) controls.\nGovernance, Risk, and Compliance\nLead information security risk assessments and maintain the Information Security Risk Register, ensuring clear risk ownership, treatment plans, and remediation tracking.\nCoordinate ISO/IEC 27001 certification and surveillance audits, internal audits, and the remediation of identified nonconformities.\nDevelop and maintain regulatory control matrices and oversee compliance with applicable cybersecurity and data protection requirements across ZainTECH's operating markets and delivery locations, including UAE Information Assurance Standards and Cyber Security Council guidance, Saudi NCA Essential Cybersecurity Controls (ECC) and Critical Systems Cybersecurity Controls (CCC), Kuwait CITRA requirements, Jordan Cybersecurity Law and Personal Data Protection Law, Egypt Personal Data Protection Law, India's Digital Personal Data Protection Act and CERT-In directions, and applicable UAE and KSA data protection regulations.\nDevelop, review, and maintain information security policies, standards, and procedures, ensuring effective governance and management of policy exceptions.\nLead security assessments of critical suppliers and third-party service providers, coordinate responses to client due diligence questionnaires, and support SOC 2 and other assurance reporting requirements where applicable.\nData Privacy and Protection\nLead the development and maintenance of the Record of Processing Activities (ROPA) across business units in coordination with the Data Protection function, ensuring periodic reviews at least annually and following significant changes.\nLead and review Privacy Impact Assessments (PIA) and Data Protection Impact Assessments (DPIA) for high-risk processing activities, new systems, AI use cases, and suppliers, recommending appropriate controls to mitigate privacy risks.\nEmbed Privacy by Design and Privacy by Default principles into security architecture reviews, change approval processes, and supplier onboarding activities.\nDefine data protection standards covering data classification, handling, retention, and disposal, alongside security controls for protecting personal data, including encryption, masking, pseudonymisation, and Data Loss Prevention (DLP).\nAssess cross-border data transfers against applicable regulatory requirements and recommend appropriate safeguards, including contractual clauses and Transfer Impact Assessments.\nOversee data subject rights processes in coordination with Legal and Data Protection, ensuring requests are handled within applicable regulatory timelines.\nLead the security aspects of personal data breach assessments and support regulatory and individual notifications within the timelines established by applicable data protection laws.\nMonitor privacy control compliance, report identified gaps and remediation actions to the CISO and Data Protection function, and contribute to privacy awareness and training initiatives.\nBusiness Impact Analysis and Business Continuity\nLead the annual Business Impact Analysis (BIA) across business units to identify critical services, processes, systems, and their dependencies on people, technology, and suppliers, presenting findings to the CISO and leadership.\nEstablish and agree on Maximum Tolerable Period of Disruption (MTPD), Recovery Time Objectives (RTO), and Recovery Point Objectives (RPO) for critical services in coordination with service owners, ensuring IT recovery capabilities meet defined objectives.\nDevelop the business continuity strategy, policies, and plans in alignment with ISO 22301, including crisis management, cyber incident recovery, and communication procedures.\nPlan and lead business continuity exercises and disaster recovery tests, document outcomes, and drive identified improvement actions through to closure.\nReview and update business impact analyses and continuity plans following significant organisational, system, or supplier changes.\nReporting, Continuous Improvement, and Mentoring\nPrepare monthly information security posture and risk dashboards and contribute to quarterly CISO reporting, providing leadership with clear visibility of security performance and exposure.\nDefine and monitor security Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs), identify opportunities for automation, and support business cases and vendor selection for new security technologies.\nMentor and review the work of Information Security Professionals, providing structured coaching and guidance to strengthen team capabilities and technical expertise.\nLead the organisation's security awareness programme, including phishing simulation strategies and targeted security training for high-risk roles.\nAct on behalf of the CISO in operational security matters when delegated.\nDecision Authority\nRecommend changes to incident severity classifications and escalation of significant incidents to the CISO.\nApprove or reject security aspects of change requests within delegated authority.\nRecommend risk acceptance decisions and information security policy exceptions to the CISO.\nDirect vulnerability and audit finding remediation priorities.\nRecommend security tools, vendors, and service providers to support the organisation's information security objectives.\nRequirements\n6-9 years of information security experience within at least 8 years of overall ICT experience, including a minimum of 2 years in a senior or leadership role. Experience should include analysing major security incidents, overseeing vulnerability management and SOC service performance, and supporting ISO/IEC 27001 certification.\nStrong knowledge of ISO/IEC 27001:2022, NIST Cybersecurity Framework (CSF) 2.0, CIS Controls, and MITRE ATT&CK, with working knowledge of applicable regional cybersecurity and regulatory requirements.\nStrong understanding of data privacy principles, data protection controls, and applicable personal data protection laws across ZainTECH's operating markets and delivery locations.\nDemonstrated experience leading Business Impact Analysis (BIA) activities and developing business continuity plans.\nExperience working with GCC or wider Middle Eastern regulatory authorities, preferably within the telecommunications, technology, or financial services sectors.\nFluency in English and Arabic is mandatory.\nBachelor's degree in Information Security, Computer Science, Information Technology, or a related field.\nAt least one valid professional certification from CISSP, CISM, GIAC GCIH, GIAC GCIA, or OSCP.\nAdditional professional certifications such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA, or CRISC.\nCloud security certifications such as CCSP, Microsoft Azure Security Engineer Associate (AZ-500), or AWS Certified Security - Specialty.\nBusiness continuity certifications such as ISO 22301 Lead Implementer or Lead Auditor, or Certified Business Continuity Professional (CBCP).\nData privacy certifications such as IAPP CIPP/E, CIPM, CIPT, or ISACA CDPSE.","description_format":"text","description_chars":10330,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"Arabic","level":"Advanced (C1)","optional":false},{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","IT Consulting & Digital Transformation","Managed IT Services (MSP)","Cloud Consulting & Migration"],"lifecycle":[{"event":"open","at":"2026-11-11T12:36:31Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":106,"reasons":["conf:0","win:early"],"computed_at":"2026-11-11T18:33:12Z"},"pay":null,"html_url":"https://alion.io/job/zaintech-senior-information-security-professional","json_url":"https://alion.io/job/zaintech-senior-information-security-professional.json","meta":{"generated_at":"2026-11-11T18:33:12Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":35702,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-12T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":5748},"rest":"https://alion.io/mcp/rest/get_company?id=5748"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fzaintech-senior-information-security-professional"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":2,"usd":0.2},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fzaintech-senior-information-security-professional"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fzaintech-senior-information-security-professional"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/zaintech-senior-information-security-professional\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fzaintech-senior-information-security-professional"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4068722}},{"tool":"search_jobs","arguments":{"company":"zaintech.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4068722},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}