Security Business Analyst

Client of Forsyth Barnes; Dubai; On-site; AED 180,000 - 260,000; Full time

Job summary

Client of Forsyth Barnes is seeking a Security Business Analyst to define and maintain security requirements across business and technology change initiatives. You will link business stakeholders, delivery teams and security specialists to create clear, testable requirements and evidence traces throughout the lifecycle.

The role emphasizes disciplined documentation, effective stakeholder engagement and early embedding of security requirements in design and build activity within a complex retail

Qualifications

• Substantial experience as a Business Analyst within information security, risk, enterprise transformation or similar delivery environment.
• Proven ability to gather, analyse, validate and control requirements across the full change lifecycle.
• Strong knowledge of requirements traceability and linking risks, controls, and evidence.

Responsibilities

• Lead discovery, analysis and documentation of security-related business, functional and technical requirements.
• Convert risk assessments and security objectives into testable, actionable requirements.
• Plan and facilitate structured workshops with business owners and security specialists.
• Establish clear acceptance criteria for design, testing and implementation.
• Maintain complete traceability across risks, controls, requirements and assurance evidence.
• Review proposed solutions to ensure security expectations are addressed.

Skills

Requirements gathering

Stakeholder engagement

Documentation

Workshops facilitation

Tools

ISO 27001

NIST CSF

Job description

The Security Business Analyst will define organise and maintain the requirements that support security delivery across business and technology change initiatives Acting as the connection between business stakeholders delivery teams and security specialists you will convert security objectives risks and control expectations into requirements that are clear testable and ready for implementation Success in this position will be measured by the quality of requirements the strength of traceability and the timely resolution of gaps and dependencies You will provide the structure needed to follow security matters from initial discovery through design delivery testing remediation and assurance while giving programme leadership an accurate view of progress and outstanding exposure The role requires confident stakeholder engagement disciplined documentation and the ability to interpret technical or security information in a business context You will support an integrated remediation and delivery approach ensuring that decisions ownership milestones and evidence remain visible throughout the lifecycle

Key Responsibilities

• Lead the discovery analysis and documentation of security-related business functional and technical requirements
• Convert risk assessments control objectives and expert security advice into practical requirements for delivery teams
• Plan and facilitate structured workshops with business owners architects engineers project managers and security specialists
• Establish clear acceptance criteria so that each requirement can be assessed consistently during design testing and implementation
• Maintain complete traceability across risks controls requirements actions decisions test outcomes and assurance evidence
• Review proposed solutions and delivery outputs with subject-matter experts to confirm that security expectations have been addressed
• Identify ambiguity omissions conflicting requirements delivery dependencies and unresolved ownership issues escalating them through the appropriate governance route
• Track remediation activities milestones dependencies and accountable owners across the integrated security plan
• Manage requirement baselines change records decision logs action registers and supporting documentation
• Monitor evidence submissions and verify that each item is relevant complete and mapped to the applicable requirement or control
• Prepare concise status updates governance packs and management information covering progress risks exceptions and upcoming decisions
• Engage early with project and technology teams to embed security requirements before design and build activity is substantially advanced
• Support delivery through testing implementation and post-delivery assurance by keeping requirements and evidence current
• Contribute to consistent security analysis practices across a complex retail distribution and marketing services environment

Substantial experience as a Business Analyst within information security, technology risk, enterprise transformation or a comparable delivery environment. Demonstrable capability in gathering, analysing, documenting, validating and controlling requirements across the full change lifecycle. Strong knowledge of requirements traceability, including the ability to connect risks, controls, requirements, acceptance criteria, remediation actions and evidence. Practical understanding of information security concepts, technology risks, control design and assurance processes. Ability to interpret technical security information and express it in precise language suitable for business stakeholders and delivery teams. Proven experience working on complex programmes involving multiple business functions, technology teams, third parties and senior stakeholders. Confidence in designing and leading workshops that produce decisions, agreed actions and well-defined requirements. Strong analytical judgement, with a structured approach to investigating gaps, testing assumptions and resolving dependencies. Experience maintaining high-quality repositories covering requirements, risks, actions, decisions, milestones and assurance evidence. Exceptional attention to detail when handling large volumes of interconnected information and time-sensitive delivery activity. Clear written and verbal communication skills, including the ability to produce concise reporting for governance forums. Experience within SAP, ERP or another large-scale enterprise transformation programme would be beneficial. Familiarity with recognised security frameworks, including ISO/IEC 27001 or the NIST Cybersecurity Framework, would be advantageous. Experience in retail, distribution, marketing services or another operationally complex commercial sector would be useful.