Senior GRC Consultant - Information Security

About the role

This role is a Senior GRC Consultant focused on information security, acting as product owner for compliance, audit, risk, findings, CAPA and exemption management modules. It requires strong knowledge of the UAE IA Standard and ISO/IEC 27001:2022, and hands-on ADHICS experience in the UAE healthcare or government sectors.

Key responsibilities

• Translate ADHICS, UAE IA Standard and ISO/IEC 27001:2022 requirements into platform controls, sub-controls, questionnaires, scoring models and audit workpapers.
• Define and maintain compliance control mappings, risk assessment frameworks and regulatory requirements.
• Run requirements workshops with information security, audit and licensing teams.
• Design evidence requirements, audit findings rules and CAPA workflows.
• Ensure platform configurations match regulatory and compliance requirements.
• Support UAT, regulatory validation and sector-wide platform rollout.

Required profile

• 10+ years of experience in Information Security GRC.
• Mandatory hands-on ADHICS experience, including assessments, audits or implementation in UAE healthcare or government.
• Experience implementing or configuring an Enterprise GRC (EGRC) platform.
• Expertise in compliance assessments, risk management, audit management, control mapping and CAPA.
• Experience with government or regulated-sector stakeholders.
• Fluency in Arabic and English (mandatory).

Required certifications

• ISO/IEC 27001 Lead Auditor certification (required)
• CISA, CRISC or CISM (required)