Director - Security and Governance

About the Role
Set the direction for security and information security governance across enterprise platforms, cloud services, and product environments. You will own security strategy, risk oversight, control assurance, and security operations, translating business priorities and customer commitments into effective protection. This director role combines executive accountability with technical judgment: building a capable security function, directing investment, and ensuring that security controls work in production.

Responsibilities

• Define and deliver the security strategy, operating model, and prioritised roadmap. Align investment, staffing, tooling, and managed services with material risks, business priorities, and delivery needs.
• Own the information security governance framework, including policies, standards, control ownership, exceptions, and assurance. Maintain practical alignment with ISO 27001, NIST CSF, CIS, and applicable obligations.
• Direct security risk management across enterprise and product environments. Maintain a clear risk register, agree treatment with accountable owners, escalate residual exposure, and ensure risk acceptance follows defined decision authority.
• Provide executive reporting on security posture, material risks, control effectiveness, incident trends, remediation, and investment trade-offs. Make decisions and unresolved exposures clear and actionable.
• Lead the security team, setting responsibilities, performance expectations, development plans, and succession priorities. Build technical capability and accountability across internal teams and managed providers.
• Own security operations outcomes across monitoring, detection engineering, alert triage, investigation, and response. Set coverage and service expectations and challenge the effectiveness of SIEM, EDR, and detection controls.
• Direct the response to major security incidents, coordinating technical containment, investigation, recovery, stakeholder communication, and post-incident review. Ensure corrective actions are completed and validated.
• Govern vulnerability and exposure management, with risk-based prioritisation, accountable remediation owners, agreed service levels, exception handling, and escalation of overdue material risks.
• Own the security compliance and assurance programme, including applicable UAE requirements, ISO 27001 certification activities, customer security commitments, and internal and external audits through verified closure.
• Set security architecture and design review standards for cloud workloads, enterprise systems, and product initiatives. Partner with Engineering on identity, access, workload protection, secure delivery, and operational controls.
• Direct customer security assurance, due diligence, questionnaires, and evidence responses, ensuring commitments accurately reflect implemented controls and agreed remediation plans.
• Govern business continuity and disaster recovery with service owners, aligning recovery objectives, dependencies, failover arrangements, and exercises with business needs. Track test findings to closure.
• Manage security budgets, vendor performance, tooling value, and managed service outcomes. Use evidence of risk reduction and control effectiveness to guide procurement and renewal decisions.
• Build security awareness and shared accountability across the organisation. Embed security reviews and practical control ownership into platform, application, and product change.

Qualifications
What We’re Looking For

• Experience leading an information security function or a substantial security domain, with accountability for strategy, delivery, line management, and measurable improvements in security posture.
• Strong governance, risk, and compliance expertise, including ownership of policy and control frameworks aligned to ISO 27001, NIST CSF, or CIS, and delivery of audit or certification programmes.
• Proven ability to translate business priorities and risk exposure into a funded security roadmap, clear operating responsibilities, and effective internal and vendor delivery.
• Deep practical security operations experience, including SIEM and detection tuning, alert triage, EDR, major incident leadership, and the ability to challenge technical findings and recovery decisions.
• Experience governing vulnerability management, risk-based prioritisation, remediation commitments, control exceptions, and escalation across platform and application owners.
• Cloud security capability across Azure or AWS, including posture management, identity and access controls, workload protection, and secure architecture patterns.
• Credible executive and technical communication, with the judgment to explain trade-offs, escalate material exposure, and maintain security standards under delivery pressure.
• Relevant professional certification such as CISSP, CISM, or a recognised cloud or security architecture certification.

Nice to Have

• Experience applying UAE security requirements and national frameworks in public-sector or regulated customer environments.
• Familiarity with Microsoft Sentinel, Defender XDR, Defender for Cloud, Purview, Entra ID, identity governance, and privileged access management.
• Experience with DevSecOps, secure SDLC, pipeline and container security, penetration testing, or threat modelling.
• Experience governing AI systems and data, including model, agent, and data protection risks, and leading continuity and recovery exercises.

What Working Here Offers

• Culture: An open, diverse, and inclusive environment with a global vision that encourages personal growth and focuses on groundbreaking, industry-first innovations.
• Career: Outstanding learning, development & growth opportunities via structured training programs and innovative, high-tech projects.
• Rewards: A competitive remuneration package with a host of perks including healthcare, education support, leave benefits and more.

If you are a performance-driven, inquisitive mind with the agility to adapt to ambiguity, eager to explore opportunities to build meaningful collaborations with stakeholders, and aspire to create unique customer-centric solutions, we’d like to hear from you.