Head of IS Risk Management

About the role

The Head of IS Risk Management oversees the full spectrum of information security risk management for the Group, including completing the review of the risk management framework to meet the Group's needs. The role identifies, assesses and treats risks to the confidentiality, integrity and availability of ADIB's assets.

Key responsibilities

• Manage and supervise cybersecurity risk assessments for business services, processes and technologies, and oversee ad-hoc and planned risk assessments in line with internal policies and external regulations.
• Review threat intelligence reports from the Group Information Security Department's Cyber Threat Intelligence unit, and vulnerability and penetration testing reports from the Attack Surface Reduction unit, and identify the risks found.
• Identify and prioritise risk scenarios, report to management, and present management reports on the Group's risk status and posture.
• Oversee risk monitoring plans and work with business units to implement mitigation controls; measure, monitor and report on information security risks.
• Manage the implementation of systems and tools to automate the end-to-end risk management cycle, and develop a threat modelling process using quantitative and qualitative measures.
• Work with the Head of IS Governance and Risk Management to improve policies, procedures and standards, and to develop remediation steps that bring risk to an acceptable level and support compliance with laws and regulations.
• Supervise projects such as integrating security into coding and testing, and develop risk dashboards.
• Review and report on vendor and third-party risk, engage staff and vendors on mitigation plans, and communicate risk status and remediation plans to internal and external stakeholders.
• Improve QA routines and controls, and regularly report exceptions to risk management policies, procedures and limits.

Required profile

• Bachelor's degree (master's preferred) in technology or a related field, or equivalent experience.
• Experience in the banking and financial services sector preferred.
• Good business and supervisory acumen.
• Knowledge of banking and financial institution processes and information security technologies, processes and systems.

Required skills

• Familiarity with GRC tools and other risk management platforms.
• Knowledge of ISO 27001, NESA, SWIFT CSP, PCI DSS and other information security standards.
• CISSP or CRISC certification strongly preferred.