Director - Security and Governance

Inception
42, a G42 company, is the region’s leading innovator of AI-powered domain-specific as well as industry-agnostic products, built on a rich heritage of research and development. Within the G42 ecosystem, Inception
42 functions as the core intelligence layer – transforming data and compute infrastructure into real-world, applied AI solutions. Beyond its commercial endeavors, Inception
42 is committed to creating positive societal impact. For more information, please visit www.inception
42.ai

Set the direction for security and information security governance across Inception
42’s enterprise platforms, cloud services, and product environments. You will own security strategy, risk oversight, control assurance, and security operations, translating business priorities and customer commitments into effective protection. This director role combines executive accountability with technical judgment: building a capable security function, directing investment, and ensuring that security controls work in production.

• Define and deliver the security strategy, operating model, and prioritised roadmap. Align investment, staffing, tooling, and managed services with material risks, business priorities, and delivery needs.
• Own the information security governance framework, including policies, standards, control ownership, exceptions, and assurance. Maintain practical alignment with ISO 27001, NIST CSF, CIS, and applicable obligations.
• Direct security risk management across enterprise and product environments. Maintain a clear risk register, agree treatment with accountable owners, escape residual exposure, and ensure risk acceptance follows defined decision authority.
• Provide executive reporting on security posture, material risks, control effectiveness, incident trends, remediation, and investment trade-offs. Make decisions and unresolved exposures clear and actionable.
• Lead the security team, setting responsibilities, performance expectations, development plans, and succession priorities. Build technical capability and accountability across internal teams and managed providers.
• Own security operations outcomes across monitoring, detection engineering, alert triage, investigation, and response. Set coverage and service expectations and challenge the effectiveness of SIEM, EDR, and detection controls.
• Direct the response to major security incidents, coordinating technical containment, investigation, recovery, stakeholder communication, and post-incident review. Ensure corrective actions are completed and validated.
• Govern vulnerability and exposure management, with risk-based prioritisation, accountable remediation owners, agreed service levels, exception handling, and escalation of overdue material risks.
• Own the security compliance and assurance programme, including applicable UAE requirements, ISO 27001 certification activities, customer security commitments, and internal and external audits through verified closure.
• Set security architecture and design review standards for cloud workloads, enterprise systems, and product initiatives. Partner with Engineering on identity, access, workload protection, secure delivery, and operational controls.
• Direct customer security assurance, due diligence, questionnaires, and evidence responses, ensuring commitments accurately reflect implemented controls and agreed remediation plans.
• Govern business continuity and disaster recovery with service owners, aligning recovery objectives, dependencies, failover arrangements, and exercises with business needs. Track test findings to closure.
• Manage security budgets, vendor performance, tooling value, and managed service outcomes. Use evidence of risk reduction and control effectiveness to guide procurement and renewal decisions.
• Build security awareness and shared accountability across the organisation. Embed security reviews and practical control ownership into platform, application, and product change.

• Experience leading an information security function or a substantial security domain, with accountability for strategy, delivery, line management, and measurable improvements in security posture.
• Strong governance, risk, and compliance expertise, including ownership of policy and control frameworks aligned to ISO 27001, NIST CSF, or CIS, and delivery of audit or certification programmes.
• Proven ability to translate business priorities and risk exposure into a funded security roadmap, clear operating…