Director - Cyber Consulting Services (GRC)

About the role

The Director of GRC Services leads the governance, risk and compliance advisory practice, with overall accountability for service delivery, client relationships, commercial performance and people leadership. The role sets the strategic direction for GRC offerings, oversees the quality of engagements across regulated and unregulated sectors and acts as the senior escalation point on technical, commercial and risk matters. It reports to the Executive Director – CCS and turns the firm's growth strategy into a high-performing, profitable and scalable GRC service line.

Key responsibilities

• Define and execute the strategy, service portfolio and go-to-market plan for GRC Services, aligned with the firm's advisory strategy.
• Own the practice P&L, including revenue targets, utilization, margin, pricing and resource planning.
• Identify emerging regulatory, governance and risk themes (e.g. ESG, data protection, AI governance) and shape new propositions and methodologies.
• Represent the firm in the market through thought leadership, industry forums, regulator engagement and speaking opportunities.
• Build trusted-advisor relationships with C-suite, board and audit-committee stakeholders.
• Lead origination and conversion of new business, including proposals, pitches, scoping and commercial negotiation.
• Drive cross-selling across other advisory and assurance lines and manage a portfolio of strategic accounts.
• Hold ultimate delivery accountability for GRC engagements, including governance reviews, enterprise risk management, regulatory compliance, internal controls, policy frameworks and risk transformation programmes.
• Review and approve key deliverables against standards such as ISO 31000, COSO ERM, ISO 27001 and local regulators (Central Bank of the UAE, DFSA/DIFC, FSRA/ADGM, SCA).
• Serve as the senior escalation point for complex technical issues, delivery risks and client concerns.
• Lead, mentor and develop managers and consultants, and build practice capability through recruitment, training, knowledge management and succession planning.

Required profile

• Minimum 12 years of relevant experience in governance, risk and/or compliance, including significant experience in a professional service or consulting environment.
• Minimum 5 years in a leadership role with delivery, P&L and business-development accountability.
• Demonstrated track record of leading and growing a practice or large engagements across regulated sectors.
• Bachelor's degree in Cybersecurity, Information Security, Computer Science, Data Analytics or a related field; Master's degree preferred.
• Experience advising on or delivering national or sector-wide cyber governance and assurance programmes is strongly preferred.

Required skills

• NIST Cybersecurity Framework (CSF), ISO/IEC 27001, ISO/IEC 27005, CIS Controls, UAE IA standards and UAE Cybersecurity Council guidance.
• TDRA cybersecurity guidelines and other UAE sectoral regulations.
• Cyber maturity models and quantitative cyber risk methods (e.g. FAIR).
• GRC platforms (e.g. ServiceNow GRC, RSA Archer or equivalent), BI tools (Power BI, Tableau), and Microsoft 365.
• Executive stakeholder management, negotiation and business development.