-
Security Programme Ownership: Own the information security strategy, programme, and roadmap, reporting directly to the CEO. Lead security for the company, setting direction, defining requirements, and answering for results.
-
Authority & Escalation: Escalate directly to the Board on material risks and hold the authority to block or delay releases, launches, or changes that carry unacceptable security risk.
-
Governance & Strategy: Serve as the executive owner of the Technology Risk Management Framework, Information Security Policy Suite, and ISMS. Ensure alignment with recognized standards (ISO 27001, NIST, SOC 2, PCI DSS) and regulatory requirements of each jurisdiction.
- DIFC: DFSA cyber risk management and technology governance requirements; DIFC Data Protection Law.
- UAE mainland: CBUAE technology risk and information security requirements, VARA Technology and Information Rulebook, UAE Personal Data Protection Law (PDPL), and UAE Information Assurance standards.
- Africa: Local data protection, cybersecurity, and central bank requirements in each market we enter, addressing data residency and localization rules.
-
Executive Reporting: Provide structured reports to the Board, ISSC, and Executive Committee (ExCo) on risk posture, control effectiveness, incident status, and residual risks.
-
Regulatory Compliance: Oversee regulatory cybersecurity reporting to governing entities within required timelines, including material incident notifications and post-incident analysis.
-
Audits & Attestations: Deliver successful outcomes for compliance audits, including ISO 27001 certification, SOC 2, and PCI DSS. Prepare for repeat and new audits, serve as primary contact for auditors, and own remediation of findings.
-
Asset Management: Lead the asset classification process and maintain the Asset Log based on Confidentiality, Integrity, and Availability (CIA) scores.
-
Data Protection: Own data classification, encryption standards, and Data Loss Prevention (DLP) controls in compliance with applicable data protection laws.
-
Identity & Access Management: Define and enforce IAM policy and oversee access reviews across all environments.
-
Threat & Vulnerability Management: Identify threats across environments using tools like OWASP Top 10, penetration testing, and threat intelligence.
-
Secure Development: Set security requirements for the software development lifecycle in collaboration with Infrastructure & DevSecOps.
-
Crypto Asset Security: Govern the security of crypto custody, wallet infrastructure, and private key management.
-
Third-Party & Vendor Risk: Conduct security due diligence and ongoing monitoring of third-party vendors and ensure appropriate security clauses in contracts.
-
Risk Mitigation: Oversee the Technology Risk Register and approve risk treatment strategies.
-
Security Controls: Implement and monitor security controls, including MFA, network segmentation, RBAC, SIEM, and IDS/IPS.
-
Incident Leadership: Command major security incidents affecting payment systems, set priorities, and keep leadership informed.
-
Incident Readiness: Own incident response procedures and ensure readiness through regular exercises.
-
Business Continuity: Coordinate Business Continuity and Disaster Recovery plans.
-
Security Visibility: Govern penetration testing and oversee continuous scanning and log analysis.
-
Financial Crime Collaboration: Work with the CCO/MLRO on fraud prevention and security data integrity.
-
Security Awareness: Run a company-wide security awareness program, including training and simulations.
-
Budget & Metrics: Own the information security budget and report security KPIs.
-
Culture & Leadership: Build and lead the Information Security function, driving a "security-first" culture.
-
Stakeholder Management: Maintain strong relationships with regulators, auditors, and third-party providers.
