Senior Specialist Information Security GRC

About the role

Tabby, a fintech money app serving customers and businesses across Saudi Arabia, the UAE and Kuwait, is looking for a Senior Specialist Information Security GRC in Dubai. The specialist independently leads complex governance, risk and compliance activities and acts as a subject matter expert in one or more GRC domains such as enterprise information security governance, risk management frameworks, regulatory compliance or third-party risk management. The role bridges technical execution and programme leadership, working with leads, legal, audit and business stakeholders within the UAE fintech regulatory environment.

Key responsibilities

• Lead the development and improvement of information security policies, standards, procedures and governance frameworks aligned with CSF, NCA ECC, ISO 27001 and PCI-DSS, and act as the expert for assigned regulatory domains
• Monitor regulatory and legal developments, prepare governance documentation and lead regulatory self-assessments and compliance attestations
• Mentor junior team members on governance documentation, regulatory interpretation and risk assessment methodology
• Lead enterprise risk assessments, maintain the risk register, run BIA processes and design control effectiveness testing programmes
• Lead third-party information security risk management, including vendor reviews and the third-party risk register
• Produce executive risk reports and compliance monitoring reports, manage audit cycles and track remediation to closure
• Design and deliver the security awareness programme and maintain GRC metrics dashboards
• Integrate security requirements into third-party contracts, procurement and project onboarding, and contribute to the security programme strategy
• Act as the main GRC point of contact for business and technology teams, lead classification and security requirement reviews, and contribute to the GRC knowledge base

Required profile

• Bachelor's degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Risk Management or a related field; a Master's is an advantage
• 3+ years of progressive experience in information security governance, risk management or compliance
• Demonstrated experience leading risk assessment cycles, regulatory compliance programmes or audit coordination
• In-depth knowledge of at least two fintech regulatory frameworks (CSF, NCA ECC, PDPL, ISO 27001, PCI-DSS)
• Experience in a regulated fintech or banking environment is strongly preferred

Required skills

• ISO 27001 Lead Implementer certification (required)
• CRISC or CISM (required or actively working toward); CDPSE is an advantage for PDPL specialists

What we offer

• Autonomy and responsibility from day one
• Employee stock options programme
• Health insurance
• Flexi perks: a monetary benefit for health, education, professional development or travel