Security Engineer - GRC/ISMS - ISR

Paramount Computer Systems; Dubai; Sur place; AED 180 000 - 300 000; Plein temps

Résumé du poste

Paramount Computer Systems in Dubai seeks a Security Engineer focusing on GRC/ISMS to lead information security governance, policy development, ISO 27001 implementation, and ongoing certification activities. The role collaborates with procurement, legal and executive stakeholders to align security controls with business needs.

You will manage risk assessments, third-party security reviews, audit coordination, incident governance, and security awareness programs, ensuring compliance with

Qualifications

• Bachelor's or Master's degree in Information Security, CS, or IS-related discipline
• 15+ years IT security exp, 10+ years GRC/ISMS
• Experience implementing ISO 27001 and third-party security reviews
• Experience audits and contract/security clauses review

Responsabilités

• Manage and improve ISMS and information security governance
• Coordinate ISO 27001 certification and surveillance activities
• Conduct risk assessments across projects, vendors and processes
• Review vendor security contracts and engage with Procurement/Legal
• Coordinate internal/external audits and prep remediation actions
• Support security incident governance, investigations and lessons learned
• Promote security awareness and governance reporting

Connaissances

Governance & ISMS

ISO 27001

Vendor risk

Audit coordination

Stakeholder mgmt

Policy development

Incident governance

Security awareness

Risk assessment

Formation

InfoSec degree

Description du poste

Role: Security Engineer - GRC/ISMS - ISR

Locations: Dubai, UAE

Job Type : FTE

Key Responsibilities:

Information Security Governance & ISMS

• Manage and continuously improve the Information Security Management System (ISMS).
• Maintain information security policies, standards, procedures, and guidelines.
• Coordinate ISO 27001 certification and surveillance activities.
• Facilitate ISMS Management Reviews and reporting.
• Monitor security objectives, KPIs, corrective actions, and improvement initiatives.
• Ensure compliance with regulatory and organizational requirements.

Risk Management

• Conduct information security risk assessments across projects, systems, vendors, and business processes.
• Facilitate risk treatment planning with risk owners.
• Monitor risk mitigation progress and elevate overdue actions.
• Support enterprise risk management activities related to cyber and technology risks.

Third-Party & Vendor Security Risk Management

• Perform vendor security assessments and due diligence reviews.
• Review security clauses in the vendor contractual documentation (MSA, SOW, DPA etc.)
• Work closely with Procurement and Legal teams during contract reviews.
• Evaluate SaaS, cloud, managed service providers, and technology vendors for information security and data privacy.
• Identify security, privacy, confidentiality, and compliance risks.
• Recommend practical risk treatment options.
• Maintain third-party risk registers and remediation actions.

Project Security Advisory

• Participate in project reviews and steering committees.
• Ensure security requirements are addressed throughout project lifecycles.

Audit & Compliance

• Coordinate internal and external audits.
• Act as primary liaison for ISO 27001 audits.
• Maintain evidence repositories.
• Track audit findings and remediation plans.
• Provide compliance reporting to management.

Security Incident Governance

• Participate in governance reviews of information security incidents.
• Support investigations, root cause analysis, and lessons learned activities.
• Assess policy violations and control failures.
• Recommend corrective and preventive actions.

Security Awareness

• Support and coordinate security awareness initiatives.
• Measure awareness effectiveness through metrics and reporting.
• Promote a security-conscious culture across the organization.

Required Qualifications:

Education

• Bachelor's or Master's degree in Information Security, Computer Science, Information Systems, or related discipline.

Experience

• 15+ years of overall experience with minimum 10+ years dedicated to Information Security GRC.
• Hands-on experience implementing and maintaining ISO 27001.
• Experience conducting third-party security assessments.
• Experience reviewing technology contracts and security clauses.
• Experience supporting audits and certification activities.
• Experience engaging with business and executive stakeholders.

Preferred Certifications

• CISSP/CISM/CISA
• CRISC
• ISO 27001 Lead Implementer/ Lead Auditor
• CDPSE
• ISO 22301 Lead Auditor / Implementer

Behavioral Competencies

• Strong stakeholder management
• Analytical thinking
• Negotiation skills
• Report writing
• Risk-based decision making
• Executive communication
• Problem solving