GRC Consultant – Information Security

About the role

We are seeking an experienced Information Security GRC Consultant to lead governance, risk and compliance initiatives for our Dubai office. The role involves shaping security policies, managing risk registers and ensuring alignment with ISO 27001 and local regulations.

Key responsibilities

• Develop, review and update information security policies in line with regulatory requirements, audit findings and industry standards.
• Define, collect, monitor and report security KPIs/KRIs to senior management, supporting ISO 27001 compliance.
• Conduct information security risk assessments, maintain risk registers and oversee risk treatment and remediation activities.
• Manage third‑party risk assessments, monitor vendor security posture and maintain the TPRM program.
• Support verification and governance review of security incidents when required.
• Coordinate with auditors, regulatory bodies and internal stakeholders to ensure effective security governance.

Required profile

• Bachelor’s or Master’s degree in Information Security, Computer Science, Information Systems or a related field.
• Minimum 5 years of hands‑on experience in information security GRC, risk management and compliance.
• Strong stakeholder management and executive communication skills.
• Experience working with business, IT, procurement, legal and senior management teams.

Required skills

• ISO 27001 implementation and auditing.
• GRC frameworks and risk management processes.
• Third‑party risk management (TPRM).
• Security KPI/KRI definition and reporting.
• Compliance with UAE PDPL, ISR and related regulations.