Senior Cybersecurity Risk & Compliance Consultant

VaporVM; Dubai; On-site; AED 320,000 - 520,000; Full time

Job summary

VaporVM is actively seeking a Senior Cybersecurity Risk & Compliance Consultant in Dubai to lead governance, risk and regulatory compliance initiatives across IT projects and cloud environments. You will conduct risk assessments, review architectures, and drive audit readiness with stakeholders across security and business teams.

The role requires hands-on security expertise, strong awareness of UAE regulations (DESC ISR, ISO 27001, NIST) and experience with enterprise GRC platforms.

Qualifications

• Minimum 10 years of experience in information security or cybersecurity.
• Experience in GRC, technical security assessments, risk management and regulatory compliance.
• Hands-on experience conducting technical security reviews and risk assessments across applications, infrastructure, networks, cloud environments, and enterprise technology solutions.

Responsibilities

• Lead cybersecurity governance, risk & compliance initiatives.
• Conduct risk assessments for applications, infrastructure, networks, cloud services, and changes.
• Review solution architectures and design for security controls and regulatory compliance.
• Develop risk treatment plans and manage exceptions and residual risk.
• Maintain enterprise GRC evidence and oversee audit readiness.

Skills

GRC governance

Technical security reviews

Risk assessments

Regulatory compliance

Security architecture

Tools

RSA Archer

Regulatory frameworks

Job description

Candidates strictly with one month notice period

Single benefit

JOB DESCRIPTION

Senior Cybersecurity Risk & Compliance Consultant

Job Information

• Job Title: Senior Cybersecurity Risk & Compliance Consultant
• Department: Information Security
• Section: IT Security & Risk Management
• Reports To: Head of Section
• Location: Dubai United Arab Emirates
• Employment Type: Full-Time Fixed-Term Contract
• Job Grade: Grade
• Job Code: Code

Job Purpose

The Senior Cybersecurity Risk & Compliance Consultant will lead cybersecurity governance risk management regulatory compliance and audit readiness while providing technical security oversight across IT projects applications infrastructure cloud environments networks and third-party solutions. The role requires a strong combination of cybersecurity Governance Risk & Compliance GRC expertise and technical security knowledge to conduct security architecture reviews technical risk assessments control effectiveness evaluations and compliance assessments. The consultant will work closely with IT cybersecurity managed services business stakeholders vendors auditors and external consultants to ensure that technology initiatives meet organizational security requirements and applicable regulatory obligations.

Key Responsibilities

• A. Cybersecurity Governance Risk & Compliance
  • Implement and maintain cybersecurity governance practices aligned with applicable UAE regulatory requirements including DESC Information Security Regulation ISR ISO 27001 NIST and organizational security policies
  • Conduct cybersecurity risk assessments for applications infrastructure networks cloud services technology projects vendors and significant IT changes
  • Identify evaluate document and track inherent and residual risks control gaps remediation actions risk owners and target closure dates
  • Develop risk treatment plans and manage security exceptions formal risk acceptances compensating controls and periodic reviews of accepted risks
  • Maintain risk registers and supporting evidence within enterprise GRC platforms such as RSA Archer or equivalent solutions
  • Monitor remediation progress and escalatereward overdue high and critical risks to management and relevant governance committees
• B. Technical Security Reviews & Risk Assessments
  • Conduct technical security reviews of solution architectures high-level and low-level designs implementation plans and technology proposals before deployment
  • Assess security risks associated with on-premises infrastructure networks operating systems databases web applications APIs cloud platforms identity and access management and security technologies
  • Review technical configurations access controls authentication mechanisms encryption network segmentation logging and monitoring vulnerability management endpoint protection and data protection controls
  • Evaluate technical security assessment reports vulnerability assessment and penetration testing findings and remediation plans
  • Review cloud and SaaS solutions system integrations third-party connectivity data flows hosting arrangements and data residency requirements against applicable security and regulatory obligations
  • Assess security requirements for technology procurement software and hardware acquisitions infrastructure changes and new implementations
  • Identify security design weaknesses misconfigurations control deficiencies and compliance gaps and recommend practical remediation measures and compensating controls
  • Verify that security requirements are addressed before go-live and ensure unresolved risks are appropriately mitigated or formally accepted by authorized stakeholders
• C. Security Architecture & Project Assurance
  • Act as a cybersecurity advisor to IT and business projects ensuring that security requirements are incorporated from the design and planning stages
  • Review proposed solutions against approved security architecture technology standards cybersecurity policies and regulatory requirements
  • Evaluate the effectiveness and suitability of security controls and technologies including firewalls Web Application Firewalls WAF Endpoint Detection and Response EDR Data Loss Prevention DLP Privileged Access Management PAM Identity Governance security monitoring and encryption
  • Collaborate with infrastructure network cloud application operations and managed services teams to address security gaps and improve control implementation
  • Provide documented security review findings recommendations conditions for approval and risk-based implementation guidance
• D. Policy Standards & Control Management
  • Develop review and maintain cybersecurity policies standards procedures and Standard Operating Procedures SOPs
  • Translate regulatory and framework requirements into implementable technical and operational security controls
  • Conduct periodic control assessments to evaluate control design implementation and operating effectiveness
  • Identify opportunities to strengthen cybersecurity processes improve control maturity and address recurring audit and risk findings

Qualifications

Minimum 10 years of experience in information security or cybersecurity, with substantial experience in GRC, technical security assessments, risk management, and regulatory compliance. Demonstrable hands-on experience conducting technical security reviews and risk assessments across applications, infrastructure, networks, cloud environments, and enterprise technology solutions. Strong understanding of security architecture, network security, operating system and database security, application security, APIs, identity and access management, encryption, vulnerability management, and security monitoring. Proven experience identifying technical vulnerabilities, evaluating security controls, assessing remediation plans, and determining residual risk. Strong knowledge of ISO 27001, NIST Cybersecurity Framework, risk management methodologies, and applicable UAE cybersecurity requirements, including DESC ISR. Experience with risk registers, audit management, policy governance, third-party risk assessments, and enterprise GRC platforms such as RSA Archer or equivalent. Experience working with IT operations, infrastructure, cloud, network, application, cybersecurity, and managed services teams in large or regulated environments. Strong analytical, report-writing, stakeholder management, and presentation skills, with the ability to communicate technical risks and business implications to senior management.