Chief Information Security Officer (CISO)

UMO; Dubai; Vor Ort; AED 350.000 - 700.000; Vollzeit

Zusammenfassung

UMO is seeking an experienced Chief Information Security Officer to own the information security programme end to end. You will lead the ISMS, risk management, and regulatory compliance across the UAE, DIFC, and Africa, reporting to the CEO and interfacing with the Board.

You'll collaborate with the CTO, COO and MLRO, chair the ISSC, and drive a Zero Trust security architecture for the money platform across fiat, crypto, and investments.

Qualifikationen

• Extensive experience leading information security programmes.
• Experience working with multinational regulations and regulators.
• Ability to define and implement an ISMS and technology risk framework.

Aufgaben

• Own information security strategy, programme, and roadmap.
• Chair Information Security Steering Committee (ISSC).
• Ensure regulatory compliance with DFSA, CBUAE, VARA and African regulators.
• Lead audits and attestations: ISO 27001, SOC 2, PCI DSS.
• Oversee asset, data, and identity management across markets.
• Drive Zero Trust and PAM implementations across the platform.

Kenntnisse

Strategic security leadership

Information security governance

Risk management

Regulatory compliance

Ausbildung

Bachelor's degree in Cybersecurity/IS/IT

Tools

ISO 27001

NIST

SOC 2

PCI DSS

Jobbeschreibung

About Us

UMO is a stealth-mode FinTech venture aiming to evolve the way people experience money by building a unified, AI-powered, yet deeply human modern money platform across fiat, crypto, and investments - subject to regulatory approvals. The platform is being designed to break down traditional barriers to money across access, assets, and experience, enabling simpler, more adaptive ways for people to interact with financial services. We are currently developing our MVP and navigating licensing requirements, with a multidisciplinary team of 100+ people representing 20+ nationalities. With our headquarters in the UAE and offices in Portugal and Ukraine, we are united behind a shared ambition and a relentless focus on serving our customers. We have zero tolerance for rudeness.

About this role

As part of our team, you'll help us shape a platform that works for One — a business owner, an artist, a freelancer.

You’ll be accountable for UMO's information security programme end to end: strategy, requirements, risk, incident readiness and results. You'll own the Information Security Management System (ISMS) and the Technology Risk Management Framework across our markets in the DIFC, UAE mainland and Africa.

You’ll report directly to the CEO / Founder and have direct access to the Board. You'll work independently of the technology function, in close partnership with the CTO, COO and CCO/MLRO, and you'll chair the Information Security Steering Committee (ISSC).

We give you real executive autonomy with no corporate friction, so you can build a resilient, Zero Trust security architecture across our money platform, end to end.

You’ll take ownership of:

• Security Programme Ownership: Own the information security strategy, programme, and roadmap, reporting directly to the CEO. Lead security for the company, not only oversee it: set the direction, define the requirements other teams must meet, and answer for the results.
• Authority & Escalation: Escalate directly to the Board on material risks, and hold the authority to block or delay releases, launches, or changes that carry unacceptable security risk.
• Governance & Strategy: Serve as the executive owner of the Technology Risk Management Framework, Information Security Policy Suite, and ISMS. Ensure alignment with recognized standards (ISO 27001, NIST, SOC 2, PCI DSS) and with the regulatory requirements of each jurisdiction we operate in:
  • DIFC: DFSA cyber risk management and technology governance requirements; DIFC Data Protection Law.
  • UAE mainland: CBUAE technology risk and information security requirements, VARA Technology and Information Rulebook (where applicable), UAE Personal Data Protection Law (PDPL), and UAE Information Assurance standards.
  • Africa: Local data protection, cybersecurity, and central bank requirements in each market we enter, including data residency and localisation rules.
• Executive Reporting: Provide structured reports to the Board, ISSC, and Executive Committee (ExCo) on risk posture, control effectiveness, incident status, and residual risks.
• Regulatory Compliance: Oversee regulatory cybersecurity reporting to the DFSA, CBUAE, VARA, and African regulators within each regulator's required timelines, including material incident notifications, detailed assessment reports, and post-incident analysis.
• Audits & Attestations: Deliver the following outcomes on an agreed plan:
  • ISO 27001: Obtain the certificate and keep it through surveillance and recertification audits.
  • SOC 2: Pass the audit and obtain an independent auditor's report.
  • PCI DSS: Pass the assessment and confirm compliance with the standard.
  • Prepare for repeat and new audits, act as the primary counterpart for auditors and regulatory inspections on security matters, and own the remediation of findings.
• Asset Management: Oversee the asset classification process (software, infrastructure, data, people) based on Confidentiality, Integrity, and Availability (CIA) scores and maintain the Asset Log.
• Data Protection: Own data classification, encryption standards, and Data Loss Prevention (DLP) controls. Work with the DPO to ensure compliance with the DIFC Data Protection Law, UAE PDPL, and African data protection laws, including cross-border data transfer and data residency requirements.
• Identity & Access Management: Define and enforce IAM policy, Zero Trust principles, and Privileged Access Management (PAM). Oversee regular access reviews across all environments.
• Threat & Vulnerability Management: Lead the identification of threats across internal configurations, external attacks, and cloud environments. Use OWASP Top 10, penetration testing, and threat intelligence.
• Secure Development (in collaboration with Infrastructure & DevSecOps): Set security requirements and standards for the software development lifecycle. Work with the Head of Infrastructure & DevSecOps, who owns their implementation (SAST/DAST, dependency scanning, secret management in CI/CD), and oversee their effectiveness.
• Crypto Asset Security: Govern the security of crypto custody, wallet infrastructure, and private key management, including HSM/MPC-based solutions.
• Third-Party & Vendor Risk: Run security due diligence and ongoing monitoring of vendors, cloud providers, and banking/BaaS partners across all markets. Ensure contracts include appropriate security and incident-notification clauses.
• Risk Mitigation: Oversee the Technology Risk Register. Approve risk treatment strategies (Mitigation, Transfer, Acceptance, Avoidance) and enforce remediation deadlines.
• Security Controls: Implement and monitor