Security Assurance Specialist (Ref: 198074)

Forsyth Barnes; Deutschland; Hybrid; EUR 90,000 - 120,000; Full time

Job summary

Forsyth Barnes is seeking a Security Assurance Specialist to provide independent oversight of information security controls across a retail, distribution and marketing environment in Dubai. The role verifies design, implementation and evidence, translating findings into clear conclusions for risk owners and governance.

You will work with technical teams and GRC colleagues to substantiate remediation, assess residual risk and help move remediation from project-based to ongoing business-as-usual

Qualifications

• Experience in information security assurance and IT risk.
• Ability to assess whether security controls are suitably designed, implemented and operating as intended.
• Familiarity with ISO/IEC 27001 and NIST CSF concepts.
• Strong analytical and written communication skills.

Responsibilities

• Develop risk-based assurance plans for priority controls and readiness milestones.
• Review control design against policies, standards and assurance frameworks.
• Test implementation and operating effectiveness when history exists.
• Record auditable working papers linking risks, controls, actions, evidence and conclusions.
• Escalate material deficiencies through governance channels.
• Contribute assurance input to consolidated security reporting and risk dashboards.
• Assess controls across identity management, vulnerability management, network security and resilience.

Skills

Information security

IT risk

GRC

Risk assessment

Analytical skills

Written communication

Independence

Stakeholder engagement

Education

CISA

CISM

CISSP

CRISC

ISO/IEC 27001 Lead Auditor

Job description

Job Description

The Security Assurance Specialist will provide structured, independent oversight of information security controls across a diverse retail, distribution and marketing environment. The role will examine whether controls are appropriately designed, implemented and supported by reliable evidence, then translate findings into clear conclusions for risk owners and governance stakeholders.

Success in this position means bringing consistency and challenge to remediation assessment while keeping recommendations practical and proportionate to risk. Working across technical teams, business stakeholders and GRC colleagues, you will help validate corrective actions, assess residual exposure and strengthen the organisation’s transition from project-based remediation into repeatable business-as-usual assurance.

Based in Dubai, the role will contribute to assessments covering security governance, technology controls and operational safeguards. Your work will support readiness activity, improve traceability between risks and controls, and provide senior stakeholders with dependable insight into the state of security assurance.

Key Responsibilities

• Develop risk-based assurance plans covering priority security controls, remediation commitments and readiness milestones.


• Review control design against internal policies, standards, risk expectations and applicable assurance frameworks.


• Test implementation and operating effectiveness where sufficient operating history is available.


• Examine evidence for accuracy, completeness, relevance, ownership and alignment to the control being assessed.


• Record structured working papers and maintain an auditable link between risks, controls, actions, evidence and conclusions.


• Challenge incomplete, outdated or inconclusive submissions and define the additional evidence required.


• Issue concise assurance findings that distinguish control gaps, evidence weaknesses and residual-risk considerations.


• Engage action owners constructively while preserving the independence and objectivity of assurance activity.


• Reassess corrected controls and confirm whether remediation addresses the underlying weakness rather than only the immediate symptom.


• Escalate material, recurring or systemic deficiencies through the appropriate governance channels.


• Contribute assurance input to consolidated security reporting, risk dashboards and management updates.


• Assess control areas including identity and access management, privileged access, segregation of duties, vulnerability management, network security and operational resilience.


• Review relevant safeguards for supplier security, data protection, security operations and technology change activity.


• Support security readiness assessments during hypercare, transformation releases and other significant implementation phases.


• Apply recognised practices from ISO/IEC 27001:2022, NIST CSF and internal information security requirements consistently.


• Coordinate with GRC, security, technology and business teams to embed a sustainable business-as-usual assurance model.

Requirements

• Several years of experience in information security assurance, technology risk, IT audit, internal controls or GRC.


• Demonstrated ability to assess whether security controls are suitably designed, implemented and operating as intended.


• Strong working knowledge of risk-based assurance principles and control testing methodologies.


• Practical understanding of ISO/IEC 27001 and NIST Cybersecurity Framework concepts.


• Experience evaluating technical and governance evidence and forming balanced, well-supported conclusions.


• Knowledge of identity and access management, privileged access, segregation of duties, vulnerability management, network protection, resilience, supplier risk, data protection and security operations.


• Ability to work effectively with control owners, engineers, auditors, risk professionals and senior stakeholders.


• Excellent analytical skills, professional judgement and written communication capability.


• Confidence working independently, organising multiple assessments and maintaining accurate assurance records.


• Experience supporting ERP, SAP or complex technology transformation programmes would be advantageous.


• Exposure to retail, distribution, marketing services or other multi-site, customer-facing operating environments would be beneficial.


• Relevant certification such as CISA, CISM, CISSP, CRISC, ISO/IEC 27001 Lead Auditor or Lead Implementer is preferred.