GRC Consultant

About the role

You will lead ISO 27001 and UAE compliance engagements for mid‑market clients, acting as the day‑to‑day security point of contact on vCISO retainers. Within a few months you will chair client governance meetings and present to management on CyberA's behalf.

Key responsibilities

• Deliver end‑to‑end ISO/IEC 27001:2022 readiness and certification engagements, including scoping, gap and risk assessment, ISMS documentation, control tracking, internal audit and certification audit support.
• Assess clients against UAE and regional frameworks (UAE IA, ADHICS, PDPL, DESC ISR, CBUAE, NCA ECC, SAMA CSF) and produce gap reports with remediation roadmaps.
• Serve as security point of contact on vCISO engagements: governance meetings, policy reviews, awareness programmes, and management/board reporting.
• Translate framework controls into technical requirements, validate implementation with Security Engineer, and configure or verify Microsoft 365 security controls (Entra ID, Intune, Defender) as needed.
• Produce client‑ready deliverables such as policies, procedures, risk registers, Statements of Applicability, assessment reports and executive summaries.
• Contribute to proposals, scoping, effort estimation and internal control mappings.
• Run multiple engagements in parallel while keeping clients informed of progress, risks and dependencies.

Required profile

• 3–5 years of experience in information security, with at least 2 years delivering GRC or compliance work.
• Successfully delivered a full‑cycle ISO 27001 (or comparable) engagement from gap assessment through audit or certification.
• Strong command of risk assessment methodology and control implementation.
• Fluent in spoken and written English with strong report writing and presentation skills.
• Willingness to work on‑site in the UAE and be based in Dubai on a CyberA‑sponsored visa.

Required skills

• ISO 27001 implementation and certification.
• Knowledge of UAE frameworks (UAE IA, ADHICS, PDPL, DESC ISR, CBUAE, NCA ECC, SAMA CSF).
• Enterprise identity and endpoint management: Active Directory, Entra ID, GCP or AWS IAM, Intune.
• Microsoft 365 security controls: Entra ID, Intune, Defender.