Third-Party Technology and AI Risk Specialist

DiceTek UAE; Abu Dhabi; On-site; AED 360,000 - 600,000; Full time

Job summary

Dicetek LLC is seeking a seasoned Third-Party Technology and AI Risk Specialist to assess vendor risks, cybersecurity controls, and AI governance in Abu Dhabi. The role encompasses due diligence, risk ratings, and residual risk documentation, with a focus on regulatory alignment and governance reporting.

Ideal candidates will have 7+ years of experience in risk management, familiarity with AI risk, cloud services, and contractual controls, and be able to coordinate with multidisciplinary teams

Qualifications

• Minimum 7 years of relevant professional experience.
• Experience in third-party risk management and due diligence.
• Knowledge of cybersecurity, privacy, and resilience risk considerations.
• Familiarity with AI vendor and model risk.
• Experience reviewing contractual control requirements.

Responsibilities

• Perform inherent-risk screening for technology vendors and AI-enabled services.
• Conduct detailed third-party risk assessments and document evidence-based risk ratings.
• Review security arrangements for cloud-based and outsourced services.
• Identify control gaps and remediation requirements.
• Monitor vendor risk throughout the lifecycle and report findings to governance bodies.

Skills

Vendor risk management

Governance

Risk assessment

Stakeholder engagement

Tools

Microsoft Power BI

Microsoft 365

Job description

Job Snapshot: Role: Third-Party Technology and AI Risk Specialist - Location: Abu Dhabi, United Arab Emirates - Industry: Banking - Function: Risk Management-Compliance - Experience: Minimum 7 years - Job Type: Full Time - Work Arrangement: On-site

Dicetek LLC is seeking an experienced Third-Party Technology and AI Risk Specialist to assess and monitor risks associated with technology vendors, cloud services, outsourced technology arrangements and AI-enabled services in Abu Dhabi, United Arab Emirates. The role focuses on third-party risk management, cybersecurity due diligence, operational resilience, data privacy and AI governance. The successful candidate will conduct inherent-risk screening, perform detailed vendor assessments and evaluate the effectiveness of security, privacy, resilience and AI-related controls.

Third-Party Risk Assessment and Due Diligence

• Perform inherent-risk screening for technology vendors and AI-enabled service providers.
• Conduct detailed third-party risk assessments based on the nature of the services provided.
• Evaluate vendor technology, cybersecurity and operational risk exposures.
• Review available vendor evidence to assess the effectiveness of relevant controls.
• Identify potential risks associated with outsourced technology services.
• Document assessment findings and assign evidence-based risk ratings.
• Prepare assessment results for relevant risk and governance stakeholders.

Cybersecurity and Cloud Due Diligence

• Assess vendor cybersecurity controls and associated technology risks.
• Review security arrangements supporting cloud-based and outsourced services.
• Evaluate relevant security documentation and control evidence.
• Identify control gaps requiring further clarification or remediation.
• Consider cybersecurity risks arising from vendor dependencies and subcontracting arrangements.
• Document security-related findings and residual risk considerations.

AI Vendor and Model Risk

• Assess risks introduced by third-party AI-enabled services.
• Review relevant AI governance controls implemented by technology vendors.
• Evaluate available evidence relating to AI-related risk management practices.
• Identify potential risks associated with third-party AI models and services.
• Document AI governance gaps and associated remediation requirements.
• Support risk decisions involving AI-enabled vendor capabilities.
• Apply appropriate governance considerations when assessing AI-related services.

Data Privacy and Operational Resilience

• Assess vendor data privacy controls and associated information risks.
• Review operational resilience arrangements relevant to outsourced services.
• Evaluate third-party dependencies that may affect service continuity.
• Consider subcontractor risks within relevant vendor arrangements.
• Identify weaknesses affecting the security, privacy or resilience of third-party services.
• Document control deficiencies and associated risk implications.

Contractual Controls and Residual Risk

• Review contractual control requirements associated with technology and AI vendors.
• Identify security, privacy, resilience and governance controls requiring contractual consideration.
• Document residual risks following vendor assessments.
• Define and track remediation actions for identified control gaps.
• Maintain records of outstanding vendor risks and agreed corrective actions.
• Support risk acceptance and governance decisions through clear assessment documentation.

Ongoing Vendor Risk Monitoring

• Monitor third-party technology and AI risks throughout the vendor lifecycle.
• Review risk implications associated with contract renewals.
• Assess material changes affecting vendor services or risk exposure.
• Maintain visibility of outstanding control deficiencies and remediation activities.
• Update vendor risk records when relevant circumstances change.
• Support continued assessment of vendor security, privacy, resilience and AI governance controls.
• Maintain appropriate monitoring plans for relevant third-party arrangements.

Risk Governance and Reporting

• Prepare vendor risk assessments for governance review.
• Document risk decisions and supporting evidence.
• Present relevant findings to technology, risk and business stakeholders.
• Maintain evidence supporting third-party risk management activities.
• Prepare reports covering vendor risk ratings, residual risks and remediation progress.
• Support governance forums with accurate and traceable risk documentation.
• Coordinate with relevant stakeholders to address assessment findings and outstanding actions.

Required Experience

• Minimum 7 years of relevant professional experience.
• Practical experience in third-party risk management, technology risk, cybersecurity risk or related governance activities.
• Experience conducting vendor risk assessments and due diligence.
• Knowledge of cybersecurity and cloud service risk considerations.
• Understanding of AI vendor and model risk.
• Experience reviewing contractual control requirements.
• Familiarity with operational resilience and data privacy controls.
• Experience documenting residual risks and remediation actions.
• Ability to prepare evidence-based risk assessments and governance reports.
• Experience working with multidisciplinary technology, risk and business stakeholders.
• Experience within regulated financial services is preferred.

Required Technical and Functional Skills

Third-Party Risk Management

• Inherent-risk screening.
• Vendor due diligence.
• Third-party risk assessment.
• Evidence-based risk ratings.
• Vendor lifecycle monitoring.
• Residual risk documentation.
• Remediation tracking.

Cybersecurity and Cloud Risk

• Cybersecurity due diligence.
• Cloud service risk assessment.
• Technology control evaluation.
• Security evidence review.
• Subcontractor risk assessment.
• Technology risk reporting.

AI Risk and Governance

• AI vendor risk assessment.
• Third-party AI model risk.
• AI governance controls.
• AI-enabled service risk evaluation.
• AI-related control gap identification.
• AI risk documentation.

Privacy, Resilience and Contractual Controls

• Data privacy risk assessment.
• Operational resilience.
• Contractual control review.
• Third-party dependency assessment.
• Risk acceptance documentation.
• Vendor monitoring requirements.

Governance and Reporting

• Governance evidence preparation.
• Risk assessment reporting.
• Risk decision documentation.
• Stakeholder coordination.
• Remediation status reporting.
• Risk monitoring plans.

Preferred Tools and Platforms

• Third-Party Risk Management (TPRM) platforms.
• Governance, Risk and Compliance (GRC) platforms.
• Microsoft 365.
• Microsoft Power BI.

Preferred Certifications and Framework Knowledge

Relevant professional certifications are preferred, including:

• Certified Information Systems Auditor (CISA).
• Certified in Risk and Information Systems Control (CRISC).
• Certified Information Systems Security Professional (CISSP).
• Certified Third Party Risk Professional (CTPRP).
• Equivalent recognised risk, security or third-party risk management certification.

Knowledge of the following standards is desirable:

• ISO/IEC 27001 - Information Security Management Systems.
• ISO/IEC 42001 - Artificial Intelligence Management Systems.

Vendor Risk Assessments

• Completed technology and AI vendor assessments.
• Documented inherent-risk screening results.
• Evidence-based vendor risk ratings.
• Supporting due diligence records.

Residual Risk and Remediation

• Documented residual risks.
• Identified security, privacy, resilience and AI governance control gaps.
• Remediation action records.
• Updated risk decisions and supporting evidence.

Contractual Controls and Monitoring

• Documented contractual control requirements.
• Third-party risk monitoring plans.
• Vendor lifecycle risk review records.
• Assessment updates for renewals and material changes.

Governance Reporting

• Vendor risk assessment reports.
• Evidence packs supporting governance forums.
• Residual risk and remediation summaries.
• Documented risk recommendations and decisions.

Professional Competencies

• Strong analytical and risk assessment capabilities.
• Ability to evaluate complex technology and third-party dependencies.
• Sound understanding of cybersecurity, privacy and operational resilience risks.
• Awareness of emerging risks associated with AI-enabled services.
• Strong documentation and evidence review skills.
• Ability to assess contractual control requirements.
• Effective communication with technology, risk and business stakeholders.
• Attention to detail when documenting residual risks and remediation actions.
• Ability to prepare clear, evidence-based recommendations for governance review.
• Organised approach to ongoing vendor risk monitoring.

Role Expectations

The Third-Party Technology and AI Risk Specialist will support effective oversight of risks introduced by external technology providers and AI-enabled services. The successful candidate will perform vendor due diligence, evaluate cybersecurity and governance controls, document residual risks and maintain appropriate monitoring throughout the third-party lifecycle. The role requires coordination with technology, risk and business stakeholders to assess vendor dependencies, identify control gaps and prepare evidence supporting governance decisions. Candidates must have at least 7 years of relevant experience. Experience in regulated financial services and recognised professional risk or security certifications will be advantageous. Immediate availability is required.

Job Details - Country: United Arab Emirates - City: Abu Dhabi - Industry: Banking - Function: Risk Management-Compliance - Salary: Not disclosed - Gender: No Preference - Candidate Nationality: Not specified - Job Type: Full Time - Work Arrangement: On-site - Required Start Date: Immediate