Security Assurance Specialist – SAP ERP Transformation

Yallo Group; Dubai; Hybrid; AED 180,000 - 240,000; Full time

Job summary

Yallo is seeking a Security Assurance Specialist to support a Dubai-based SAP ERP transformation. The role focuses on validating security controls, evidence and assurance conclusions across IAM, SoD, vulnerability management and data protection in an on-site/hybrid setup.

You will interact with architects and engineers to challenge designs and ensure compliance with ISO 27001:2022 and group security standards, while maintaining auditable records through go-live and hypercare phases.

Qualifications

• 6-10 yrs of overall workex with at least 3-5 yrs in security assurance, IT audit, technology risk or GRC.
• Hands-on experience assessing control design and effectiveness against ISO 27001:2022 and NIST CSF.
• Understanding of IAM and SoD, vulnerability management, network security, integrations, data protection and security operations.
• Experience reviewing both technical and governance evidence.
• SAP or ERP transformation experience is a strong advantage.
• ISO 27001 Lead Auditor is highly preferred; CISA, CISSP, CISM or CRISC a plus.

Responsibilities

• Assess security controls and remediation evidence for design, implementation and operating effectiveness.
• Decide whether the evidence submitted is enough to close a control and document assurance conclusions.
• Work with technical leads to identify control gaps and follow up with owners.
• Maintain an auditable record tracing each risk to controls, actions and evidence.
• Support reassessment of residual risk and security readiness across go-live and subsequent releases.
• Escalate recurring or material control weaknesses.
• Help hand controls over to business-as-usual assurance.

Job description

Job Role: Security Assurance Specialist – SAP ERP Transformation
Location:Dubai, UAE (on-site/hybrid)
Type:12-month contract, renewable
Start:Immediate

About the role:

Yallo is hiring a Security Assurance Specialist for a leading Dubai-based retail group client. The client is running a major SAP ERP transformation. You will independently check whether the programme’s security controls have been designed, implemented and evidenced properly against ISO 27001 and group security standards.

This role sits between GRC and technical security. You need the audit discipline to reach defensible conclusions, and enough technical depth to challenge architects and engineers on how systems are actually secured.

What you’ll do:

• Assess security controls and remediation evidence for design, implementation and operating effectiveness
• Decide whether the evidence submitted is enough to close a control, and document clear assurance conclusions
• Work with technical leads and architects to find control gaps, then follow up with the people who own the actions
• Keep an auditable record that traces each risk to its controls, actions and evidence
• Support reassessment of residual risk and security readiness across go-live, hypercare and later releases
• Escalate recurring or material control weaknesses
• Help hand controls over to business-as-usual assurance

What you’ll bring:

• 6-10 yrs of overall workex with at least 3–5 yrs of strong experience in security assurance, IT audit, technology risk or GRC
• Hands-on experience assessing control design and effectiveness against ISO 27001:2022 and NIST CSF
• Enough technical understanding to judge evidence across IAM and SoD, vulnerability management, network security, integrations, data protection and security operations
• Experience reviewing both technical and governance evidence
• SAP or ERP transformation experience is a strong advantage
• Clear analytical thinking and written communication
• ISO 27001 Lead Auditor is highly preferred. CISA, CISSP, CISM or CRISC is a plus.