Senior Security Business Analyst

YALLO Group; Dubai; On-site; AED 300,000 - 500,000; Full time

Job summary

YALLO Group in Dubai is hiring a Senior Security Business Analyst to support a major SAP ERP transformation for a leading retail group. You will sit in the security workstream, turn security requirements into clear, traceable business and technical needs, and maintain end-to-end evidence and risk traceability from design through go-live.

The role demands autonomous working, confident workshops, and fluency with security terminology, with emphasis on ISO 27001 and NIST CSF references and

Qualifications

• 6-10 years as a Business Analyst, with 2-3 years in security, technology risk or GRC projects.
• Strong requirements management and end-to-end traceability across delivery lifecycle.
• Working knowledge of security controls and ISO 27001 or NIST CSF familiarity.
• Experience on complex programmes with multiple business, technology and third-party stakeholders.
• Excellent written and verbal communication for technical and non-technical audiences.
• SAP or ERP programme experience is advantageous.

Responsibilities

• Run workshops with security specialists and stakeholders to gather requirements.
• Translate security requirements into business, functional and technical specifications with clear acceptance criteria.
• Maintain end-to-end traceability between risks, controls, requirements, and evidence.
• Track evidence submissions and map them to the corresponding requirements or controls.
• Prepare workstream reports and governance materials.
• Identify gaps and drive resolution across the security remediation plan.

Job description

About the role

Yallo is hiring a Senior Security Business Analyst for a leading Dubai-based retail group client. The client is running a major SAP ERP transformation. You will sit in the programme's security workstream and turn security requirements into clear, traceable business and technical requirements. You’ll keep every risk, control, action and piece of evidence linked from design through to go-live.

This role suits a BA who works independently, runs workshops with confidence and is comfortable with security terminology.

What you’ll do

• Run workshops with security specialists, business stakeholders and delivery partners to gather and clarify requirements
• Turn security requirements into clear business, functional and technical requirements, each with acceptance criteria
• Keep end-to-end traceability between risks, controls, requirements, remediation actions and evidence
• Track evidence submissions and map each one to the right requirement or control before it goes for assurance
• Maintain action registers, decision logs, dependencies and milestones for the security remediation plan
• Spot gaps, inconsistencies and dependencies early, and drive them to resolution
• Prepare workstream reports and governance material

What you’ll bring

• 6-10 years as a Business Analyst, including at least 2-3 years on security, technology risk or GRC projects
• Strong requirements management and traceability skills across the full delivery lifecycle
• Working knowledge of security controls and principles, so you can follow security conversations and translate them
• Experience on complex programmes with many business, technology and third-party stakeholders
• Structured and detail-focused, able to manage a large volume of requirements and actions accurately
• Clear written and verbal communication with both technical and non-technical audiences
• SAP or ERP programme experience, and familiarity with ISO 27001 or NIST CSF, are an advantage

Skills

• 6-10 years as a Business Analyst, including at least 2-3 years on security, technology risk or GRC projects
• Strong requirements management and traceability skills across the full delivery lifecycle
• Working knowledge of security controls and principles, so you can follow security conversations and translate them
• Experience on complex programmes with many business, technology and third-party stakeholders
• Structured and detail-focused, able to manage a large volume of requirements and actions accurately
• Clear written and verbal communication with both technical and non-technical audiences
• SAP or ERP programme experience, and familiarity with ISO 27001 or NIST CSF, are an advantage