Security Engineer - GRC/ISMS

Paramount Computer Systems; Dubai; On-site; AED 350,000 - 650,000; Full time

Job summary

Paramount Computer Systems in Dubai seeks a Security Engineer specializing in GRC/ISMS to lead our information security program and drive ISO 27001 compliance across projects.

You will manage the ISMS, perform risk assessments, oversee third-party security reviews, and collaborate with executives, procurement, and legal to ensure regulatory alignment.

This senior role requires 15+ years in information security and 10+ years in GRC.

Qualifications

• Bachelor's or Master's in Information Security, CS, IS, or related field.
• 10+ years in Information Security GRC with 15+ years total experience.
• Hands-on ISO 27001 implementation and maintenance.
• Experience in third-party security assessments and contract reviews.
• Experience engaging with executives.

Responsibilities

• Manage and continuously improve the Information Security Management System (ISMS).
• Maintain information security policies, standards, procedures, and guidelines.
• Coordinate ISO 27001 certification and surveillance activities.
• Facilitate ISMS Management Reviews and reporting.
• Monitor security objectives, KPIs, corrective actions, and improvement initiatives.
• Ensure compliance with regulatory and organizational requirements.
• Conduct information security risk assessments across projects, systems, vendors, and business processes.
• Facilitate risk treatment planning with risk owners.
• Monitor risk mitigation progress and elevate overdue actions.
• Support enterprise risk management activities related to cyber and technology risks.
• Perform vendor security assessments and due diligence reviews.
• Review security clauses in vendor contractual documentation (MSA, SOW, DPA etc.).
• Work closely with Procurement and Legal teams during contract reviews.
• Evaluate SaaS, cloud, managed service providers, and technology vendors for information security and data privacy.
• Identify security, privacy, confidentiality, and compliance risks.
• Recommend practical risk treatment options.
• Maintain third-party risk registers and remediation actions.
• Participate in project reviews and steering committees.
• Ensure security requirements are addressed throughout project lifecycles.
• Coordinate internal and external audits.
• Act as primary liaison for ISO 27001 audits.
• Maintain evidence repositories.
• Track audit findings and remediation plans.
• Provide compliance reporting to management.
• Participate in governance reviews of information security incidents.
• Support investigations, root cause analysis, and lessons learned activities.
• Assess policy violations and control failures.
• Recommend corrective and preventive actions.
• Support and coordinate security awareness initiatives.
• Measure awareness effectiveness through metrics and reporting.
• Promote a security-conscious culture across the organization.

Skills

GRC/ISMS

ISO 27001

Stakeholder management

Audits & compliance

Risk assessment

Vendor security

Education

Bachelor's or Master's in Information Security/CS/IS

Job description

Role: Security Engineer - GRC/ISMS

Locations: Dubai, UAE

Job Type - FTE

Key Responsibilities:

Information Security Governance & ISMS

• Manage and continuously improve the Information Security Management System (ISMS).
• Maintain information security policies, standards, procedures, and guidelines.
• Coordinate ISO 27001 certification and surveillance activities.
• Facilitate ISMS Management Reviews and reporting.
• Monitor security objectives, KPIs, corrective actions, and improvement initiatives.
• Ensure compliance with regulatory and organizational requirements.

Risk Management

• Conduct information security risk assessments across projects, systems, vendors, and business processes.
• Facilitate risk treatment planning with risk owners.
• Monitor risk mitigation progress and elevate overdue actions.
• Support enterprise risk management activities related to cyber and technology risks.

Third-Party & Vendor Security Risk Management

• Perform vendor security assessments and due diligence reviews.
• Review security clauses in the vendor contractual documentation (MSA, SOW, DPA etc.)
• Work closely with Procurement and Legal teams during contract reviews.
• Evaluate SaaS, cloud, managed service providers, and technology vendors for information security and data privacy.
• Identify security, privacy, confidentiality, and compliance risks.
• Recommend practical risk treatment options.
• Maintain third-party risk registers and remediation actions.

Project Security Advisory

• Participate in project reviews and steering committees.
• Ensure security requirements are addressed throughout project lifecycles.

Audit & Compliance

• Coordinate internal and external audits.
• Act as primary liaison for ISO 27001 audits.
• Maintain evidence repositories.
• Track audit findings and remediation plans.
• Provide compliance reporting to management.

Security Incident Governance

• Participate in governance reviews of information security incidents.
• Support investigations, root cause analysis, and lessons learned activities.
• Assess policy violations and control failures.
• Recommend corrective and preventive actions.

Security Awareness

• Support and coordinate security awareness initiatives.
• Measure awareness effectiveness through metrics and reporting.
• Promote a security-conscious culture across the organization.

Required Qualifications:

Education

• Bachelor's or Master's degree in Information Security, Computer Science, Information Systems, or related discipline.

Experience

• 15+ years of overall experience with minimum 10+ years dedicated to Information Security GRC.
• Hands-on experience implementing and maintaining ISO 27001.
• Experience conducting third-party security assessments.
• Experience reviewing technology contracts and security clauses.
• Experience supporting audits and certification activities.
• Experience engaging with business and executive stakeholders.

Preferred Certifications

• CISSP/CISM/CISA
• CRISC
• ISO 27001 Lead Implementer/ Lead Auditor
• CDPSE
• ISO 22301 Lead Auditor / Implementer

Behavioral Competencies

• Strong stakeholder management
• Analytical thinking
• Negotiation skills
• Report writing
• Risk-based decision making
• Executive communication
• Problem solving