Lead - Security Governance and Assurance

Inception
42, a G42 company, is the region's leading innovator of AI-powered domain-specific as well as industry-agnostic products, built on a rich heritage of research and development. Within the G42 ecosystem, Inception
42 functions as the core intelligence layer – transforming data and compute infrastructure into real-world, applied AI solutions. Beyond its commercial endeavors, Inception
42 is committed to creating positive societal impact. For more information, please visit www.inception
42.ai

Inception
42, a G42 company, is the region's leading innovator of AI-powered domain-specific as well as industry-agnostic products, built on a rich heritage of research and development. Within the G42 ecosystem, Inception
42 functions as the core intelligence layer – transforming data and compute infrastructure into real-world, applied AI solutions. Beyond its commercial endeavors, Inception
42 is committed to creating positive societal impact. For more information, please visit (Use the "Apply for this Job" box below)..ai

Lead security governance and assurance with identity and access management as the primary technical focus. Own the access model, policies, controls, and evidence used by auditors, regulators, and customers. Act as the hands-on identity design authority, guide engineers and analysts, and manage identity tooling and vendors, working with Information Security, Platform Engineering, Application Support, Internal Audit, HR, and system owners.

• Own the identity and access management strategy and roadmap, covering joiner-mover-leaver lifecycle, authentication, authorisation, privileged access and federation.
• Design and maintain the organisation's role-based access control model, including role definitions, entitlement structures and segregation of duties, and keep it workable as the business changes.
• Own access governance, including periodic access reviews and certification, entitlement recertification, and evidence that least privilege is applied in practice rather than in policy.
• Set the standards and patterns for privileged access management across infrastructure, applications and endpoints, including endpoint privilege management and the removal of standing local administrator rights, so that elevation is controlled, time-bound and auditable.
• Optimise existing privileged access tooling and make an evidence-based case for change where it limits required controls.
• Define how applications integrate with identity, covering SSO, SAML, OAuth and OIDC, Conditional Access and modern authentication, and review integrations against those standards before they go live.
• Automate identity lifecycle and access provisioning to reduce manual effort and the errors that come with it.
• Own the security governance framework for the domain, including policies, standards and control definitions mapped to ISO 27001, NIST CSF and applicable UAE requirements.
• Lead assurance activity across control testing, internal and external audit, and customer security due diligence, and drive findings through to closure.
• Provide security review and design authority for new systems, cloud workloads and acquisitions, with particular attention to how identity and access are handled.
• Define and report identity and access metrics, including privileged account inventory, standing administrator rights, orphaned and dormant accounts, review completion, provisioning performance and exceptions.
• Mentor engineers and analysts, and raise the standard of identity practice across the wider technology function.
• Within six months, assess privileged, dormant, standing, and endpoint administrator access; prioritise and close the most material risks; agree the target RBAC model; and establish evidenced access reviews and…