Lead - Security Governance and Assurance

About the Role
Lead security governance and assurance with identity and access management as your primary technical focus. You will own the access model, policies, controls, and evidence used by auditors, regulators, and customers. Acting as the hands-on identity design authority, you will guide engineers and analysts, manage identity tooling and vendors, and collaborate with Information Security, Platform Engineering, Application Support, Internal Audit, HR, and system owners.

Responsibilities
What You’ll Own

• Own the identity and access management strategy and roadmap, covering joiner-mover-leaver lifecycle, authentication, authorization, privileged access, and federation.
• Design and maintain the organisation's role-based access control model, including role definitions, entitlement structures, and segregation of duties, while ensuring it remains workable as the business evolves.
• Own access governance, including periodic access reviews and certification, entitlement recertification, and evidence that least privilege is applied in practice rather than in policy.
• Set the standards and patterns for privileged access management across infrastructure, applications, and endpoints, ensuring elevation is controlled, time-bound, and auditable.
• Optimize existing privileged access tooling and justify changes where necessary to meet required controls.
• Define application integration with identity, covering SSO, SAML, OAuth, OIDC, Conditional Access, and modern authentication, while reviewing integrations against those standards prior to going live.
• Automate identity lifecycle and access provisioning to reduce manual effort and associated errors.
• Own the security governance framework for the domain, including policies, standards, and control definitions mapped to ISO 27001, NIST CSF, and applicable UAE requirements.
• Lead assurance activity across control testing, internal and external audit, and customer security due diligence, driving findings through to closure.
• Provide security review and design authority for new systems, cloud workloads, and acquisitions, focusing on identity and access management.
• Define and report identity and access metrics, including privileged account inventory, standing administrator rights, orphaned and dormant accounts, review completion, provisioning performance, and exceptions.
• Mentor engineers and analysts, raising the standard of identity practice across the wider technology function.
• Within six months, assess privileged, dormant, standing, and endpoint administrator access; prioritize and close the most material risks; agree on the target RBAC model; and establish evidenced access reviews and integration standards.
• Within twelve months, implement RBAC and segregation of duties across priority systems; reduce standing privilege through time-bound, auditable access; automate identity lifecycle; close audit findings without recurrence; and use routine metrics and knowledge sharing to enhance identity capability.

Qualifications
What We’re Looking For

• Deep, hands-on expertise across enterprise identity and access management, including identity governance and administration, single sign-on, multi-factor authentication, and privileged access management across infrastructure and endpoints.
• Experience in designing and implementing an RBAC model at the enterprise scale, including role engineering, entitlement design, and segregation of duties that operates effectively.
• Strong capability in Microsoft Entra ID, including Conditional Access, Privileged Identity Management, hybrid identity, and application registration.
• Practical experience with at least one enterprise IGA platform, such as SailPoint, Saviynt, or equivalent, including access certification campaigns and lifecycle automation.
• Security governance and assurance capability, along with experience writing policies and control standards against ISO 27001 or NIST, successfully navigating internal and external audits.
• In-depth knowledge of federation and modern authentication protocols, including SAML, OAuth 2.0, and OIDC, with the ability to critically review application integrations.
• Experience acting as a technical design authority or senior technical lead, establishing and defending standards.
• Proficiency in communicating access risk clearly to engineers, auditors, and business stakeholders, without relying solely on policy.

Nice to Have

• Familiarity with privileged and endpoint privilege management tooling, including ManageEngine PAM360, Application Control Plus, and endpoint privilege controls; experience with CyberArk, BeyondTrust, or Microsoft Intune EPM is also relevant.
• Skills in identity lifecycle automation and scripting, including PowerShell and integration with HR systems as the identity source.
• Understanding of UAE regulatory requirements and experience within public sector or regulated customer environments.
• Experience with identity integration during mergers, acquisitions, or organizational restructuring.
• Knowledge of cloud security posture and workload identity in Azure or AWS, including service principals, managed identities, and secrets management.
• Relevant certifications such as CISSP, CISM, Microsoft Identity and Access Administrator, or ISO 27001 lead auditor qualification.
• Governance experience related to access to AI systems and data, including agent and service identity.

Benefits

• Culture: An open, diverse, and inclusive environment with a global vision that encourages personal growth and focuses on groundbreaking, industry-first innovations.
• Career: Outstanding learning, development & growth opportunities via structured training programs and innovative, high-tech projects.
• Rewards: A competitive remuneration package accompanied by numerous perks, including healthcare, education support, leave benefits, and more.