Information Security Program Manager

VaporVM; Dubai; On-site; AED 250,000 - 500,000; Full time

Job summary

VaporVM in the UAE seeks an experienced ISMS lead to plan, drive and manage end-to-end ISO/IEC 27001 programs, including scope definition, timelines, budget, resources and stakeholder reporting. You will review policies, assess alignment with ISO/IEC 27001:2022 and 27002, evaluate current controls, perform gap analysis, and develop remediation roadmaps across people, process and technology.

Strong knowledge of CIS Controls, CIS Benchmarks, UAE Dubai regulations and healthcare data protection

Qualifications

• Bachelor's degree in Information Security, Information Technology, Computer Science or a related field.
• 7–10+ years of experience in information security, including at least 3 years leading ISMS, security risk or compliance programs.
• Proven track record of leading at least one ISO/IEC 27001 implementation or certification.
• In-depth knowledge of ISO/IEC 27001:2022, ISO/IEC 27002 and ISO/IEC 27005, and of risk assessment methodologies.
• Hands-on experience implementing and assessing the CIS Critical Security Controls and CIS Benchmarks, including the use of configuration compliance scanning tools.
• Solid technical understanding of networks, operating systems, cloud platforms, identity and access management, and security technologies (e.g., firewalls, SIEM, EDR, vulnerability scanners).
• Working knowledge of ISO/IEC 20000-1 and ISO 22301; hands-on implementation or audit experience with these standards is a strong advantage.
• Familiarity with UAE and Dubai information security regulations and healthcare data protection requirements.
• Experience in healthcare or government environments is preferred.

Responsibilities

• Plan, lead and manage the end-to-end ISO/IEC 27001 program, including ISMS scope definition, timelines, budget, resources and stakeholder reporting.
• Review existing information security policies, standards, procedures and records to assess completeness and alignment with ISO/IEC 27001:2022 and ISO/IEC 27002.
• Examine current security practices and controls across people, processes and technology to evaluate how effectively they operate in practice.
• Conduct a detailed gap analysis against ISO/IEC 27001 requirements (Clauses 4 10 and Annex A controls) and produce a prioritized remediation roadmap.
• Develop and maintain the information security risk management methodology, and conduct periodic technical risk assessments of applications, infrastructure, networks, cloud services and medical and clinical systems.
• Maintain the information security risk register and risk treatment plans, and track the implementation of treatments with risk and control owners.
• Coordinate periodic vulnerability assessments, penetration tests and configuration reviews, and ensure findings are risk-rated, remediated and verified.
• Establish and manage a CIS-based compliance program, adopting the CIS Critical Security Controls (v8) and CIS Benchmarks as secure configuration baselines for operating systems, databases, network devices, cloud platforms and applications.
• Conduct periodic CIS compliance assessments using automated scanning tools (e.g., CIS-CAT Pro, Tenable, Qualys), track compliance scores against agreed targets, and coordinate remediation or documented exceptions with system owners.
• Prepare and maintain the Statement of Applicability (SoA) and the documentation required for the ISMS, including the ISMS scope, policy, objectives and supporting procedures.
• Assess information security risks of third parties and suppliers, and ensure appropriate security requirements are included in contracts.
• Establish and run the ISMS internal audit program and management reviews, and track nonconformities and corrective actions through to closure.
• Preparefor Stage 1 and Stage 2 re-certification audits and ongoing surveillance audits, coordinate with the certification body, and lead the response to any findings.
• Define information security KPIs and metrics, and generate and present periodic (monthly and quarterly) reports covering risk posture, control effectiveness, vulnerability and remediation status, CIS compliance scores, security incidents, audit findings and awareness completion, to support management reviews and decision-making.
• Drive information security awareness and training so that staff understand their responsibilities within the ISMS.
• Ensure the ISMS aligns with Company s policies and applicable UAE and Dubai Government information security and data protection requirements, including the UAE Information Assurance Standards, Dubai Electronic Security Center (DESC) requirements and healthcare data regulations.

Skills

Program and change management

Risk-based thinking

Stakeholder management

Analytical thinking

English communication

Facilitation and training

Education

Bachelor's degree in Information Security

Job description

Plan, lead

and manage the end-to-end ISO/IEC 27001 program, including ISMS scope definition, timelines, budget, resources and stakeholder reporting.

Review existing information
security policies, standards, procedures and records to assess completeness and
alignment with ISO/IEC 27001:2022 and ISO/IEC 27002.

Examine current security
practices and controls across people, processes and technology to evaluate how effectively they operate in practice.

Conduct a detailed gap analysis
against ISO/IEC 27001 requirements (Clauses 4 10 and Annex A controls) and produce a prioritized remediation roadmap.

Develop and maintain the
information security risk management methodology, and conduct periodic
technical risk assessments
of applications, infrastructure, networks, cloud services and medical and
clinical systems.

Maintain the information security risk register and risk treatment plans, and track the implementation of treatments with risk and control owners.

Coordinate periodic vulnerability
assessments, penetration tests and configuration reviews, and ensure findings are risk-rated, remediated and verified.

Establish and manage a CIS-based
compliance program, adopting the CIS
Critical Security Controls (v8) and CIS Benchmarks as secure configuration baselines for operating systems, databases, network devices, cloud platforms and applications.

Conduct periodic CIS compliance assessments using automated scanning tools (e.g., CIS-CAT Pro, Tenable, Qualys), track compliance scores against
agreed targets, and coordinate remediation or documented exceptions with system owners.

Prepare and maintain the Statement of Applicability (SoA) and the documentation required for the ISMS, including the ISMS scope, policy, objectives and supporting procedures.

Assess information security risks
of third parties and suppliers, and ensure appropriate security requirements are included
in contracts.

Establish and run the ISMS
internal audit program and management reviews, and track nonconformities and corrective actions through to closure.

Preparefor Stage 1 and Stage 2 re-certification audits and ongoing surveillance
audits, coordinate with the certification body, and lead the response to any findings.

Define information security KPIs
and metrics, and generate and
present periodic (monthly and
quarterly) reports covering risk posture, control effectiveness,
vulnerability and remediation status, CIS compliance scores, security
incidents, audit findings and awareness completion, to support management
reviews and decision-making.

Drive information security awareness and training so that staff understand their responsibilities within the ISMS.

Ensure the ISMS aligns with Company s
policies and applicable UAE and Dubai Government information security and data protection requirements, including the UAE Information Assurance
Standards, Dubai Electronic Security Center (DESC) requirements and healthcare data regulations.

2. Secondary Responsibilities

Support the implementation, maintenance and certification of the IT Service Management System (ISO/IEC 20000-1) and the Business Continuity Management System (ISO 22301), working closely with the IT Service Management and Business Continuity teams.

Align ISMS controls with ITSM processes, including incident, problem, change,
configuration, capacity, availability and supplier management.

Contribute to business impact
analysis (BIA), the definition of recovery objectives (RTO/RPO) and continuity risk assessments for critical IT services and information assets.

Support the development, review and
testing of IT service continuity, disaster recovery and business continuity plans, and ensure lessons learned are captured and acted upon.

Identify opportunities for an
integrated management system across ISO/IEC 27001, ISO/IEC 20000-1 and ISO
22301, including shared policies, documentation, internal audits and management
reviews.

Support internal and external audits for ISO/IEC 20000-1 and ISO 22301, including evidence preparation and follow-up of corrective actions.

4. Preferred Certifications

ISO/IEC 27001 Lead Implementer and/or Lead Auditor

CISSP, CISM or CISA

ISO/IEC 20000-1 and/or ISO 22301 Lead Implementer or Lead Auditor (advantageous)

CRISC or an equivalent risk management certification
(advantageous)

PMP, PRINCE2 or equivalent project management certification

5. Key Competencies

Program and change management

Risk-based thinking and sound technical judgement

Stakeholder management and ability to influence without direct authority

Analytical thinking and attention to detail

Excellent written and verbal communication in English (Arabic is an advantage)

Facilitation, coaching and training
delive

Desired Candidate Profile

3. Qualifications and Experience

Bachelor s degree in Information Security, Information Technology, Computer Science or a related field.

[7 10]+ years of experience in information security, including at least [3] years leading ISMS, security risk or compliance programs.

Proven track record of leading at least one ISO/IEC 27001 implementation or certification.

In-depth knowledge of ISO/IEC 27001:2022, ISO/IEC 27002 and ISO/IEC 27005, and of risk assessment
methodologies.

Hands-on experience implementing
and assessing the CIS Critical Security Controls and CIS Benchmarks, including the use of configuration compliance scanning tools.

Solid technical understanding of networks, operating systems, cloud platforms, identity and access management, and security technologies
(e.g., firewalls, SIEM, EDR, vulnerability scanners).

Working knowledge of ISO/IEC 20000-1 and ISO 22301; hands-on implementation or audit experience with these standards is a strong advantage.

Familiarity with UAE and Dubai information security regulations and healthcare data protection requirements.

Experience in healthcare or government
environments is preferred.