AVP Security Incident Management (UAE National)

About the role

The Assistant Vice President, Security Incident Management will lead the incident response team within the Cyber Defense Center, ensuring timely and effective handling of security incidents for a major bank in the UAE. The role coordinates stakeholders, drives incident response maturity, and aligns security operations with business priorities.

Key responsibilities

• Lead the incident response team and coordinate major security incidents and crisis management.
• Manage investigation, analysis, containment, recovery, communication, and reporting for each incident.
• Develop, refine, and maintain incident management policies, procedures, and playbooks.
• Conduct post‑incident reviews to capture lessons learned and implement improvements.
• Provide training, mentorship, and guidance to team members.
• Maintain clear communication with stakeholders throughout the incident lifecycle.
• Oversee strategic direction of incident management to ensure alignment with organizational goals.
• Monitor security hygiene, review use cases/playbooks for SIEM/SOAR tools, and collaborate with IS, Ops, and technology teams to enhance resilience.

Required profile

• 12+ years of experience in information security, with at least 6‑8 years dedicated to security incident response.
• Hands‑on experience implementing and operationalising SIEM/SOAR platforms such as Sentinel and ArcSight.
• Proven ability to define and report KPIs for security incident response.
• Familiarity with advanced SOC monitoring technologies, risk, threat, and security measures.
• Strong knowledge of governance, control frameworks, compliance, risk management, and incident response domains.
• Comprehensive understanding of regulatory and compliance requirements influencing a bank’s security strategy.
• Preferably experience in the BFSI sector with a solid SOC background.
• Deep knowledge of security standards such as NIST 800‑61, CERT/CC, PCI, and ISO 27035.

Required skills

• SIEM tools – Sentinel, ArcSight.
• SOAR platforms and automation of security processes.
• Incident response frameworks and methodologies.
• Security standards – NIST 800‑61, CERT/CC, PCI, ISO 27035.
• KPI definition and reporting for incident management.
• Use‑case and playbook development for SIEM/SOAR tools.
• Security posture assessment tools and methodologies.