Cyber Security Manager

ALDAR; Abu Dhabi; Presencial; AED 350.000 - 600.000; Jornada completa

Descripción de la vacante

Aldar Estates seeks a senior Cyber Security leader to own end-to-end execution of SAFW requirements, reducing operational cyber risk while enabling safe delivery across estates, IoT/OT environments, and third-party ecosystems.

You will align with central SOC, security governance, and architecture functions to ensure enterprise consistency and drive risk-based decisions with clear owners and deadlines.

Formación

• Bachelor’s degree in Cybersecurity, IT, CS, Engineering, or a related field.
• CISSP, CISM, CRISC, GIAC or equivalent preferred.
• 10+ years of cyber security leadership in enterprise environments.

Responsabilidades

• Own end-to-end execution of entity-controlled cyber and SAFW requirements.
• Align with central SOC, governance, and architecture functions for enterprise consistency.
• Own risk-to-remediation closure with defined owners, target dates, and evidence.
• Manage IoT/OT/robotics security: asset inventory, firmware remediation, and secure access.
• Enforce zoning and segmentation hygiene; close internet-facing high-risk exposures.
• Maintain a risk-prioritized entity cyber roadmap and ensure actions are closed.
• Partner with central SOC on detection and response; coordinate containment and closure.
• Drive closure of third-party findings with procurement, legal, and owners.
• Translate post-incident lessons into local controls and evidence-based improvements.

Conocimientos

Cyber governance

Risk management

Incident response

Stakeholder comms

Educación

Bachelor’s degree in Cybersecurity or related field

CISSP (preferred)

CISM or CRISC (preferred)

GIAC (preferred)

Descripción del empleo

Job Purpose

• Own end-to-end execution of entity-controlled cyber and SAFW requirements for Aldar Estates, reducing operational cyber risk while enabling safe delivery across estates operations, IoT/OT environments, and third-party ecosystems.
• Align and integrate with central SOC, security governance, and architecture functions for enterprise consistency

Roles, Responsibilities, Duties

Operating & Approval Radius

• R3 – high, end-to-end local execution: own risk-to-remediation closure for entity-controlled requirements, with named owner, target date, and closure evidence.
• A2 – bounded authority: approve local control actions within delegated thresholds; recommend higher-threshold risk acceptance with evidence-based decision packs; elevate material risk, regulatory-impact incidents, and repeated critical SLA breaches to central authority.

SAFW Entity Execution Ownership

• Endpoint hardening and health: baseline compliance, backlog closure, exception reduction, and evidence reporting.
• IoT/OT/robotics security: asset inventory, segmentation, onboarding checks, firmware and vulnerability remediation, and secure remote/vendor access.
• Local network exposure: enforce zoning and segmentation hygiene and close internet-facing high-risk exposures.

Risk Leadership & Action Closure

• Maintain a risk-prioritized entity cyber roadmap and produce evidence-based recommendations, ensuring approved actions are closed.
• Govern exception aging, compensating controls, and due-date integrity

Security Operations & Incident Resilience

• Partner with central SOC on detection and response; own local containment coordination and corrective-action closure.
• Convert post-incident lessons into local control changes and improve MTTD/MTTR and repeat-incident rates.

Third-Party & Supply-Chain Security

• Apply group security requirements to vendor onboarding and operations; drive closure of third-party findings with procurement, legal, and operational owners.
• Re-certify privileged and remote vendor access at defined cadence.

Governance & Architecture Alignment

• Align delivery with central policy, architecture standards, and assurance requirements; feed back local constraints; support audits with source-traceable evidence.

Entity vs Central SAFW Split

• Entity-owned (end-to-end): endpoint hardening, IoT/OT/robotics controls, local third-party enforcement, exception workflow, and incident corrective actions.
• Central-owned: SOC platform, group policy and standards, architecture baselines, and high-threshold risk acceptance.

Human + AI Workflow Model (First 12 Months)

• P1 AI-drafted documentation; P2 AI-assisted triage with human validation gates; P3 AI-orchestrated vulnerability, exception, and third-party risk workflows; P4 (stretch) KPI-driven workflow tuning.
• Guardrails: AI drafts and proposes; humans approve risk decisions, exceptions, and executive statements. Material recommendations need source-traceable evidence and confidence indication; no AI-only approvals.

Key Performance Indicators

• Critical vulnerability remediation within SLA (%), by risk tier; exception aging and closure rate by severity.
• End-to-end cycle time from risk detection to verified closure; repeat incident/control-failure rate.
• Automation coverage of priority workflows (%); AI recommendation override rate with root-cause classification.
• Alignment with Group Infosec Security Architecture and Governance Frameworks (%).

Education & Qualification:

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.

• Preferred certifications: CISSP, CISM, CRISC, GIAC (or equivalent).

• Demonstrated delivery across governance, operational risk reduction, and cross-functional execution.

• Hands-on fluency in endpoint, network exposure, IoT/OT operational security constraints, and third-party security execution

Experience and Skills:

Industry Experience (No. of years):

• 10+ years in cyber security with leadership accountability in enterprise environments.

Competencies and Skills:

• Cyber security governance, operational risk reduction, and control assurance

• Endpoint, network exposure, and IoT/OT/robotics security

• Vulnerability, exception, third-party, and incident action closure

• Human plus AI workflow orchestration with verification and escalation discipline

• Executive communication, stakeholder alignment, and action-closure discipline

• Analytical thinking, risk judgment, problem-solving, and continuous improvement