Lead Consultant- GRC

Cpx Affiliate; Abu Dhabi; On-site; AED 350,000 - 550,000; Full time

Job summary

Cpx Affiliate is seeking a Lead Consultant – Cyber Consulting Services to own GRC and information security initiatives for a government regulatory entity and its regulated sector in the UAE. You will guide policies and risk management, ensuring alignment with ADHICS and ISO/IEC 27001.

You will mentor junior staff, coordinate audits, and act as the senior client liaison with regulatory bodies, driving continuous improvement in security maturity across the sector.

Qualifications

• Advanced understanding of GRC processes, control frameworks, risk assessment methods, and compliance monitoring practices, with ability to lead workstreams and quality-assure deliverables.
• Minimum 9 years of experience in governance, risk, compliance, and information security, including leading GRC workstreams or teams within UAE healthcare/regulatory environments.
• Bachelor's degree in IT, Cybersecurity, CS, Risk Management, Business Administration, or related field; a Master's is preferable.

Responsibilities

• Own and lead end-to-end delivery of GRC and information security workstreams; act as senior client contact and set technical direction.
• Lead development, implementation, and continuous improvement of information security policies, standards, and templates; align with ADHICS and ISO/IEC 27001.
• Drive risk management programs: risk identification, assessment, treatment, monitoring, and escalation of significant risks.

Skills

GRC processes

Control frameworks

Risk assessment

Compliance monitoring

ADHICS knowledge

Delivery leadership

Stakeholder management

Mentoring & coaching

Communication

Attention to detail

Education

Bachelor's degree in IT/Cybersecurity/CS/Risk Management

Master's degree or postgraduate qualification (preferable)

Job description

Job Purpose: -

The Lead Consultant – Cyber Consulting Services is a senior individual-contributor and delivery‑lead role responsible for owning and driving the definition, enforcement, and monitoring of Governance, Risk and Compliance (GRC) and Information Security initiatives for a leading government regulatory entity and its regulated sector. The role holder leads GRC workstreams end‑to‑end, sets the technical direction and quality standards for deliverables, and acts as the senior point of contact with the client and regulatory stakeholders. Operating within a healthcare regulatory environment, the role ensures compliance with, and continuous improvement of, the Information Security maturity of the organization and its wider regulated sector in alignment with the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standard and applicable UAE regulatory requirements. The role holder is expected to independently plan and execute programs, guide and quality‑assure the work of consultants, and mentor junior team members, without carrying full people‑management accountability.

Key Responsibilities: -

Own and lead the end‑to‑end delivery of assigned GRC and Information Security workstreams for the organization and its regulated sector, acting as the senior point of contact with the client and regulatory stakeholders. Plan and sequence activities, set technical direction and quality standards for deliverables, manage workstream risks, dependencies, and timelines, and ensure that milestones are met and outcomes exceed stakeholder expectations

Lead the development, implementation, and continuous improvement of Information Security policies, standards, procedures, guidelines, and templates for the organization and its regulated sector, aligned to legal, regulatory, and international best practices, including the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standard and ISO/IEC 27001.

Lead and mature the Information Security Risk Management Program for the organization and its regulated sector; drive risk identification, assessment, treatment, and monitoring, and coordinate with mission assurance programs to manage Information Assurance, Information Security, and Cyber Security risks, escalating significant risks with clear remediation recommendations.

Define and execute compliance management initiatives and lead Information Security audits for the organization and its regulated sector. Establish measures to assess operational capabilities, determine compliance and control effectiveness levels, and coordinate audits with internal and external agencies, tracking findings through to closure.

Serve as a senior liaison with internal business functions, local and international sector stakeholders, and regulatory bodies on Information Security matters, deviations, exemptions, and incidents, ensuring timely, well‑informed, and professionally represented engagement on behalf of the organization.

Guide, review, and quality‑assure the work of consultants and junior team members within assigned workstreams, providing technical direction, coaching, and constructive feedback. Mentor junior staff to foster growth and a healthy delivery culture, and support resource and knowledge‑sharing across the team, without carrying full line‑management accountability.

Provide expert advisory by reviewing contracts, MoUs, agreements, and documents, and represent Information Security on relevant committees and forums. Define and report performance, deviations, challenges, and risks with remedial proposals, and elevate matters to the Information and Cyber Security Office Leadership as required.

Skills/Certifications (Technical & Non-Technical)

Advanced understanding of GRC processes, control frameworks, risk assessment methods, and compliance monitoring practices, with a proven ability to lead workstreams and quality‑assure deliverables. In-depth, working knowledge of the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standard and its application, together with familiarity with UAE healthcare regulatory and information security requirements, is mandatory. Preferred certifications: Certified Information Systems Security Professional (CISSP); Certified Information Security Manager (CISM); Certified Information Systems Auditor (CISA); Certified in Risk and Information Systems Control (CRISC); ISO/IEC 27001 Lead Implementer or Lead Auditor; ISO 31000 Risk Manager or equivalent; Certified in the Governance of Enterprise IT (CGEIT).

Workstream and Delivery Leadership; Risk‑Based Thinking; Quality Assurance and Review; Policy and Documentation; Analytical Skills; Stakeholder and Expectation Management; Mentoring and Coaching; Communication; Attention to Detail; Integrity and Confidentiality.

Minimum Work Experience & Education: -

Minimum of 9 years of experience in governance, risk, compliance, and Information Security, including demonstrable experience leading GRC workstreams or teams and quality‑assuring deliverables. A substantial and demonstrable portion of this experience must be within the UAE healthcare sector or a healthcare regulatory environment, and must include cybersecurity, technology risk, regulatory compliance, or audit management activities, along with hands‑on experience implementing, assessing, or advising against the Abu Dhabi Healthcare Information and Cyber Security (ADHICS) Standard.

Bachelor's degree in Information Technology, Cybersecurity, Computer Science, Risk Management, Business Administration, or a related field. A Master's degree or relevant postgraduate qualification is preferable.