Technical Assurance Manager

About the Role / About the Job:
Lead the company's second-line technical security assurance across infrastructure, applications, databases, cloud, networks, security platforms, and critical business services. The role owns the risk-based Technical Assurance Plan, methodologies, and tools; provides evidence-based conclusions on control design, implementation, compliance, and operating effectiveness; leads technical regulatory assurance, Red Team assurance, and cyber resilience assurance; and conducts independent challenges, reports, retests, and validates remediation. First-line functions remain accountable for control ownership, operation, and remediation, while this role operates from a second-line assurance level.

Key Accountabilities of the Role:

• Develop and execute a risk-based annual assurance plan covering critical services, technologies, controls, and relevant third parties.
• Maintain the assurance universe and prioritize reviews using criticality, threats, regulatory obligations, change, incidents, and prior findings.
• Independently test control design, implementation, compliance, and operating effectiveness using evidence-based methods.
• Own assurance methodologies, test scripts, sampling, and evidence standards, aligned with NIST, ISO 27001, PCI DSS, SWIFT CSCF, UAE, and CBUAE requirements.
• Operate assurance tools and expand automated or continuous monitoring to identify control drift, gaps, and non-compliance.
• Assess findings by likelihood, exploitability, impact, criticality, and compensating controls; align ratings with the Enterprise Risk Framework.
• Lead second-line technical assurance for regulatory and industry obligations, maintaining traceability from requirements to controls and evidence.
• Define and govern threat-informed Red Team exercises; coordinate specialist execution and validate preventive, detective, response, and recovery controls.
• Use penetration-testing and vulnerability results as assurance evidence, avoiding duplication of first-line specialist testing.
• Assure cyber resilience, recovery integrity, security-control survivability, crisis simulation, dependency mapping, and applicable RTO/RPO evidence required for Cybersecurity and privacy.
• Assess AI/ML and AI-enabled technologies, including access, data protection, integration security, monitoring, prompt/output integrity, and adversarial testing.
• Own the finding lifecycle from evidence validation and risk rating through escalation, independent retesting, and closure.
• Provide assurance validation to projects and technology change without assuming first-line control ownership in line with the assurance plan.
• Support inspections and audits with complete, accurate, and audit-ready evidence, working papers, and responses.
• Coordinate with Cyber Defense, Technology, Risk, Compliance, Internal Audit, and control owners while preserving second-line independence.
• Manage and develop the Technical Assurance team and keep assurance scope, methods, and tooling current with emerging threats and regulatory changes.

Specialist Skills / Technical Knowledge Required for this Role:

• Must Have
  • Deep expertise in second-line technical assurance and evidence-based assessment across infrastructure, applications, databases, cloud, networks, and security platforms.
  • Strong knowledge of control design and operating-effectiveness assessment.
  • Working knowledge of major information security, cybersecurity, and regulatory control frameworks.
  • Strong technical risk assessment, evidence evaluation, documentation, stakeholder management, and executive reporting skills.
  • Bachelor’s or master’s degree in information security, cybersecurity, engineering, computer science, IT, or a related discipline.
• Desired
  • Knowledge of NIST SP 800-53A and NIST SP 800-115 assessment principles.
  • Familiarity with ISO/IEC 27001, NIST CSF, PCI DSS, SWIFT CSCF, UAE Information Assurance, and CBUAE requirements.
  • Practical experience with automated compliance, continuous assurance, technical telemetry, configuration evidence, and security-platform data.
  • Understanding of penetration testing, vulnerability assessment, Red/Purple Team methods, MITRE ATT&CK, OWASP, PTES, and CIS Benchmarks.
  • Knowledge of IAM/PAM, SIEM/SOC, DLP, cryptography, certificate management, CSPM/CASB, WAF, DDoS, and endpoint security.
  • Understanding of cyber resilience, recovery controls, dependency validation, recovery integrity, and resilience-testing evidence.
  • Relevant certifications such as CISA, CISSP, CRISC, CISM, OSCP, GPEN, GIAC, or PCI ISA/QSA; combined assurance and technical credentials are preferred.