Senior Information Security Professional

About the role

ZainTECH is looking for a Senior Information Security Professional to act as the technical authority within the CISO Office. The role provides independent oversight and in-depth analysis of security incidents and vulnerability assessment reports from the Security Operations Centre (SOC) and Vulnerability Assessment (VA) teams, and drives cloud security, risk management and regulatory compliance. It also gives technical guidance and mentorship to Information Security Professionals.

Key responsibilities

• Review and analyse major security incidents, advise the CISO on business impact, regulatory notification and stakeholder communication, and oversee the Incident Response Policy and tabletop exercises
• Maintain the Vulnerability Management Policy, assess vulnerability and penetration test reports, and coordinate remediation priorities and risk exceptions
• Review security architectures and cloud security posture management across Microsoft 365, Azure and AWS, and guide Zero Trust, privileged access and DLP
• Lead information security risk assessments, maintain the risk register, and coordinate ISO/IEC 27001 audits and regulatory compliance matrices
• Lead the Record of Processing Activities, Privacy Impact Assessments, data protection standards and cross-border transfer safeguards
• Lead the annual Business Impact Analysis, set RTO/RPO targets, develop business continuity plans aligned with ISO 22301 and run continuity exercises
• Produce monthly security dashboards, define KPIs and KRIs, mentor security professionals and lead the security awareness programme

Required profile

• 6-9 years of information security experience, including at least 8 years of ICT experience and 2 years in a senior or leadership role
• Demonstrated experience with incident analysis, vulnerability management, SOC oversight and ISO/IEC 27001 certification
• Experience leading Business Impact Analysis and developing business continuity plans
• Experience with GCC or wider Middle Eastern regulators, preferably in telecom, technology or financial services
• Bachelor's degree in Information Security, Computer Science, Information Technology or a related field
• Fluency in English and Arabic is mandatory

Required skills

• Certification such as CISSP, CISM, GIAC GCIH/GCIA, OSCP, CCSP, AZ-500, AWS Security Specialty, ISO 22301, IAPP CIPP/E or CISA
• Knowledge of ISO/IEC 27001:2022, NIST CSF 2.0, CIS Controls and MITRE ATT&CK
• Working knowledge of regional cybersecurity and data protection regulations