Sr Information Security Governance & Assurance Manager

QatarYello; Dubai International Financial Centre; On-site; AED 450,000 - 750,000; Full time

Job summary

QatarYello is seeking a seasoned information security and GRC leader to own and advance the ISMS and assurance programmes in a fintech/regulatory environment. You will drive ISO 27001 certification, SOC 2 readiness, and remediation while coordinating with engineering, product, and operations teams to strengthen controls.

Ideal candidates bring 10+ years in information security and a track record of delivering audits, evidence programmes, and compliant security across cloud environments.

Qualifications

• At least 10 years' experience across information security or related disciplines.
• Experience in fintech, payments, digital banking, investment, or regulated environments.
• Direct experience leading ISO 27001 certification and ISMS operations.
• Direct experience leading SOC 2 Type I and/or Type II readiness/examinations.
• Track record of implementing controls, evidence programmes and audits with remediation.
• Experience collaborating with engineering, cloud and product teams in cloud environments.
• Practical experience supporting external audits, client diligence and customer security assessments.
• Knowledge of AI governance, AI risks or security assurance.

Responsibilities

• Lead day-to-day security governance, certification and assurance programme.
• Own ISMS, including ISO 27001 certification, surveillance and continual improvement.
• Lead SOC 2 Type I/II readiness and examinations, including control mapping and evidence management.
• Build and maintain security control frameworks, evidence programmes, and remediation processes.
• Work with engineering, product and operations to implement and improve security controls.
• Perform control testing, identify deficiencies and drive remediation to closure.
• Coordinate external audits, due diligence, security questionnaires and assurance requests.
• Develop reporting on certification status, control effectiveness, findings and remediation.
• Improve assurance activities through automation and continuous monitoring.

Skills

Security governance

ISMS

SOC 2 readiness

Audit coordination

Automation / monitoring

Cloud security

Education

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor

CISA

CRISC

CISM

CISSP

Tools

GRC tooling

Audit management software

Evidence management tools

Job description

A growing FS organisation in the Middle East.

• Lead the day-to-day security governance, certification and assurance programme.
• Own the ISMS, including ISO 27001 certification, surveillance, recertification and continual improvement.
• Lead SOC 2 Type I / II readiness and examination activities, including control mapping, evidence management and auditor coordination.
• Build and maintain security control frameworks, policies, evidence programmes and remediation processes.
• Work directly with engineering, product and operational teams to implement and improve security controls.
• Perform control testing, identify deficiencies and drive remediation through to verified closure.
• Coordinate external audits, due diligence, security questionnaires and assurance requests.
• Develop clear reporting on certification status, control effectiveness, findings, exceptions and remediation.
• Improve assurance activities through automation, reusable evidence, continuous monitoring and appropriate GRC tooling.

• At least 10 years' experience across information security, security assurance, technology risk or a related discipline, including a minimum of five years in security GRC or assurance.
• Experience in fintech, payments, digital banking, investment, financial services or another regulated environment.
• Direct experience leading ISO 27001 certification and operating an ISMS.
• Direct experience leading SOC 2 Type I and/or Type II readiness and examinations.
• A track record of personally implementing controls, building evidence programmes and driving audits and remediation to successful outcomes.
• Experience working closely with engineering, cloud and product teams in cloud environments.
• Practical experience supporting external audits, client diligence and customer security assessments.
• Tangible experience in AI governance, AI risks or security assurance.
• Relevant qualifications such as ISO 27001 Lead Implementer or Lead Auditor, CISA, CRISC, CISM or CISSP would be advantageous.