Lead Cyber Security Engineer

Dubai Insurance Co.; Dubai; In loco; AED 450.000 - 750.000; Tempo pieno

Descrizione del lavoro

Dubai Insurance Co. is seeking a hands-on Technical Security Lead to build, run, and test security controls and to manage compliance for a CBUAE-regulated insurer. About 70% focused on technical work and 30% on proving compliance with evidence from your own work.

You’ll run security operations for an in-house SOC, own core controls end-to-end, and lead VAPT and audits to close gaps with evidence for the Board.

Competenze

• 8–12 years of hands-on cyber security engineering or operations experience.
• Experience managing outsourced SOC, leading incidents, VAPT and audit findings.
• ISO 27001 implementation or audit experience.
• Direct experience with UAE regulators: CBUAE, UAE IA, DoH/ADHICS or DHA.
• At least one hands-on technical certification (OSCP, GCIH, GCIA, GCFA, GPEN, AZ-500, or vendor cert).
• Scripting in PowerShell or Python for automation.

Mansioni

• Run security operations as in-house owner of outsourced SOC; develop detections and lead incidents.
• Own core controls hands-on: DLP, MDM, patching, vulnerability management.
• Set security requirements for vendors and sign-off before go-live.
• Scope and commission VAPT; reproduce findings and close on evidence.
• Hardening of endpoints, cloud, identity, PAM, zero trust, firewall/WAF reviews.
• Lead GRC and reporting with ISO 27001, UAE regs; produce monthly metrics and quarterly risk reports.

Conoscenze

SOC management

Incident response

VAPT

Vulnerability management

ISO 27001

UAE regulator experience

Technical certifications

PowerShell/Python scripting

Bachelor's degree

Formazione

Bachelor's degree in Computer Science, Information Security, Engineering or related field

Descrizione del lavoro

We are seeking a highly motivated and experienced hands-on technical security lead to build, run and test our security controls. You'll also lead compliance for a CBUAE-regulated insurer. This is not a strategy-only or GRC-only role. About 70% of your time goes on technical work. The other 30% goes on proving compliance, using the evidence your own work produces.

What you'll do

• Run security operations. You'll be the in-house technical owner of our outsourced SOC (MSSP). That means challenging triage, building new detections (including insurance-specific threats such as claims fraud and health data exfiltration), running purple-team tests and leading major incidents.
• Own the core controls hands-on. This covers DLP (Purview/Forcepoint), Intune/MDM, patching, and vulnerability management from start to finish, prioritised by CVSS, EPSS and CISA KEV.
• Secure business applications. You'll work on policy, claims and underwriting platforms, ERP, portals, mobile apps and APIs. You'll set security requirements for vendors and give security sign-off before go-live.
• Manage VAPT. You'll scope and commission tests, reproduce key findings yourself, and close findings only on evidence.
• Harden endpoints, infrastructure and the network. This includes EDR/XDR, Azure/AWS/M365, Entra ID, PAM, zero trust, and firewall and WAF reviews.
• Lead GRC and reporting. You'll keep one audit gap tracker, maintain a unified control framework (ISO 27001, ADHICS, UAE IA, CBUAE, PDPL) and produce monthly metrics plus a quarterly cyber risk report for the Board.

What you’ll bring

• 8–12 years of hands-on cyber security engineering or operations experience
• A track record of managing an outsourced SOC, leading real incidents, running VAPT and vulnerability programmes, and closing audit findings
• ISO 27001 implementation or audit experience
• Direct experience with UAE regulators: CBUAE, UAE IA, DoH/ADHICS or DHA
• At least one hands‑on technical certification, such as OSCP, GCIH, GCIA, GCFA, GPEN, AZ-500, or a firewall or EDR vendor cert (CISSP, CISM, CISA and similar are a plus but don't replace this)
• Scripting in PowerShell or Python for automation
• A Bachelor's degree in Computer Science, Information Security, Engineering or a related field

Nice to have

• A background in insurance, takaful, brokers or TPAs (especially health insurance), or in CBUAE-regulated banking
• Exposure to DESC ISR, SAMA CSF or NCA ECC