Senior Information Security GRC Specialist

About the role

Tabby is seeking a senior specialist to lead its information security governance, risk and compliance (GRC) programme across the UAE. The role combines technical execution with programme leadership, working closely with legal, audit and business teams to meet fintech regulatory requirements.

Key responsibilities

• Develop, review and improve security policies, standards and governance frameworks aligned with CSF, NCA ECC, ISO 27001 and PCI‑DSS.
• Lead complex enterprise risk assessments, maintain the risk register and produce executive‑level risk reports.
• Manage third‑party security risk, design assessment frameworks and maintain the vendor risk register.
• Coordinate regulatory self‑assessments, compliance attestations and audit cycles, ensuring evidence quality and timely remediation.
• Design and deliver security awareness programmes and maintain GRC metrics dashboards.

Required profile

• Bachelor’s degree in IT, Cybersecurity or related field; Master’s degree is a plus.
• 3+ years progressive experience in information security governance, risk management or compliance, preferably in a regulated fintech environment.
• ISO 27001 Lead Implementer certification (required) and CRISC or CISM (required or in progress).

Required skills

• Risk assessment (qualitative & quantitative) and control effectiveness testing.
• Compliance monitoring for ISO 27001, PCI‑DSS, CSF, NCA ECC and PDPL.

What we offer

• Autonomous work environment with responsibility from day one.
• Employee stock options programme.
• Health insurance and flexible monetary perks for wellbeing, education or travel.