Log In
Sign Up
Information Security Compliance Officer Jobs in Abu Dhabi, UAE
Job Description
- Responsible for the planning, development and implementation of cybersecurity policies, procedures, standards, and controls. Leads day to day compliance audits/assessments, governance, and risk management functions to ensure the protection of corporate information systems, networks, and data.
Responsibilities
- Continuously validate the organization against policies, guidelines, procedures, regulations, and laws to ensure compliance.
- Develop an annual compliance plan to ensure adequate auditing of compliance to cyber security policies and guidelines.
- Develop and maintain detailed compliance monitoring mechanisms and frameworks.
- Execute periodic and ad-hoc compliance checks and cyber risk assessments to ensure that cyber security controls and measures are adherent to the mandated cyber security policies and guidelines.
- Develop policy compliance reports including required corrective actions and recommendations.
- Conduct cyber security risk assessments based on current state of adherence to policies and rate of adoption of security controls and mechanisms.
- Provide remedial actions against non-compliance and collaborate to develop plans to reach a state of compliance.
- Follow up on the implementation status of defined corrective actions to adhere to policies.
- Organize policies, standards training, and awareness based the on periodic release of updated regulations or compliance mechanisms as required.
- Assess the effectiveness of security controls.
- Support necessary compliance activities (e.g., ensure that system security configuration guidelines are followed, compliance monitoring occurs).
- Review authorization and assurance documents to confirm that the level of risk is within acceptable limits for each software application, system, and network.
- Develop security compliance processes and/or audits for external services (e.g., cloud service providers, data centres).
- Ensure compliance with regulatory requirements across the emirates such as ADHICS, Riyathi.
- Ensure compliance with the standards such as ISO 27001, SOC 2 & PCI DSS.
- Perform access review of the systems such as VPN, Removable Media, Audit logs, Admin access, Antivirus, PAM Access.
- Provide input to the Risk Management Framework process activities and related documentation (e.g., system life-cycle support plans, concept of operations, operational procedures, and maintenance training materials).
- Participate in Risk Governance process to provide security risks, mitigations, and input on other technical risk. • Assure successful implementation and functionality of security requirements and appropriate policies and procedures that are consistent with the organization’s mission and goals.
- Manage Information Security Business Continuity Plans.
- Ensure that plans of actions and milestones or remediation plans are in place for vulnerabilities identified during risk assessments, audits, inspections, etc.
- Ensure that security design and cybersecurity development activities are properly documented (providing a functional description of security implementation) and updated as necessary.
- Ensure that all acquisitions, procurements, and outsourcing efforts address information security requirements consistent with organization goals.
- Ensure the security of bio-medical equipment’s.
- Manage the internal relationship with information technology (IT) process owners supporting the service, assisting with the definition and agreement of Operating Level Agreements (OLAs).
- Ensure including information security requirements in project management and ensure the protection of data during the project management lifecycle.
- Develop the strategy, goals, and objectives for the cyber security training, and awareness program.
- Develop new or identify existing awareness and training materials that are appropriate for intended audiences.
- Evaluate the effectiveness and comprehensiveness of existing training and awareness programs.
Qualifications
- Bachelor’s degree in computer science/engineering, information security, software engineering, systems engineering, Electronics & Communication Engineering, or information systems.
- Lead Auditor/Implementer ISO 27001
- Lead Auditor/Implementer ISO 22301
- Certified Information Security Manger (CISM)
- Certified Information Security Auditor (CISA)
- Certified Risk and Information Systems Control (CRISC)
- Certified Information Systems Security Professional (CISSP)
- GRC Professional (GRCP) • Certified Governance of Enterprise IT (CGEIT)
