Senior Security and Compliance officer

Role Overview

The Senior Security and Compliance Officer will lead the end-to-end implementation and oversight of the organization's information security governance, risk management, and compliance (GRC) initiatives.

The role is dedicated to ensuring alignment with global standards and regional regulatory frameworks within a highly regulated environment.

Key Responsibilities

Governance & Compliance

Manage full lifecycle compliance with ISO/IEC 27001, PCI DSS v4.0.1, NIST, UAE PDPL, UAE Central

Bank regulations, and other applicable laws.

Develop, review, and maintain information security policies, procedures, and governance documents.

Serve as the single point of contact for InfoSec compliance.

Risk Management

Lead technology and information security risk assessments across all domains.

Maintain centralized risk registers with clear ownership, treatment plans, and traceability.

Provide regular risk posture reports and validate remediation effectiveness.

Audit & Regulatory Oversight

Plan and manage audits, inspections, regulatory assessments, and certifications.

Coordinate internal and external stakeholder responses and ensure closure of findings.

PCI DSS v4.0.1 Compliance

Own PCI DSS compliance program, including scoping, assessment coordination, remediation, and

documentation management.

Track scope-impacting changes in systems or vendors.

Awareness & Training

Design and manage induction and awareness programs via LMS platforms.

Automate training lifecycle and track compliance for audit readiness.

Vendor & Third-Party Risk

Perform third-party risk assessments and ensure contractual compliance with InfoSec, PCI DSS, and CPR requirements.

Continuous Improvement

Monitor regulatory changes and drive maturity improvements across GRC processes and tooling.

Qualifications & Experience

Education: Bachelor's in InfoSec, Computer Science, Risk Management, or related fields.

Experience: 8+ years in Information Security GRC roles, preferably in banking, fintech, or regulated sectors.

Certifications (Preferred): CISSP, CISM, CRISC, ISO 27001 LA/LI, PCI DSS.

Core Skills

Deep understanding of information security frameworks and risk governance.

Strong documentation, analytical, and stakeholder engagement capabilities.

Ability to operate independently with strategic thinking and execution.

Success Metrics

Sustained PCI DSS and regulatory compliance.

Timely risk remediation and validated risk closures.

Strong audit performance and visibility of risk posture improvements.