Strategic Security BA for SAP ERP Transformation

YALLO Group; Dubai; On-site; AED 300,000 - 500,000; Full time

Job summary

YALLO Group in Dubai is hiring a Senior Security Business Analyst to support a major SAP ERP transformation for a leading retail group. You will sit in the security workstream, turn security requirements into clear, traceable business and technical needs, and maintain end-to-end evidence and risk traceability from design through go-live.

The role demands autonomous working, confident workshops, and fluency with security terminology, with emphasis on ISO 27001 and NIST CSF references and

Qualifications

• 6-10 years as a Business Analyst, with 2-3 years in security, technology risk or GRC projects.
• Strong requirements management and end-to-end traceability across delivery lifecycle.
• Working knowledge of security controls and ISO 27001 or NIST CSF familiarity.
• Experience on complex programmes with multiple business, technology and third-party stakeholders.
• Excellent written and verbal communication for technical and non-technical audiences.
• SAP or ERP programme experience is advantageous.

Responsibilities

• Run workshops with security specialists and stakeholders to gather requirements.
• Translate security requirements into business, functional and technical specifications with clear acceptance criteria.
• Maintain end-to-end traceability between risks, controls, requirements, and evidence.
• Track evidence submissions and map them to the corresponding requirements or controls.
• Prepare workstream reports and governance materials.
• Identify gaps and drive resolution across the security remediation plan.

Job description

YALLO Group in Dubai is hiring a Senior Security Business Analyst to support a major SAP ERP transformation for a leading retail group. You will sit in the security workstream, turn security requirements into clear, traceable business and technical needs, and maintain end-to-end evidence and risk traceability from design through go-live.

The role demands autonomous working, confident workshops, and fluency with security terminology, with emphasis on ISO 27001 and NIST CSF references and