Assistant Manager, Security Governance & Compliance

Operating in the UAE for over 50 years, CBD manages the financial requirements of some of the largest corporates and businesses operating in the country, driving the UAE economy. Over the years, CBD has transformed into a progressive and modern banking institution winning multiple awards for its digital initiatives, credit cards, bank accounts, mobile app features and services.

CBD has been recognized as the number one bank in the UAE on the Forbes list of The World’s Best Banks 2022.

As we continue to build upon our successes, we are looking for ambitious individuals who are passionate about the banking and finance industry and the markets in which CBD operates. Just as important to us is your ability to demonstrate a talent for dealing with people - your colleagues and our customers and delivering service that really goes the extra mile.

• Spearheading and managing Security Governance, Risk Assessment and Security Compliance programs.
• Liaise with internal and external stakeholders and actively act as key influencer in security decisions
• Conduct independent security risk assessments, compliance reviews and train other staff members
• Support and work closely with business & Information technology to review new initiatives, implement Application Security Program, Manage third party vendors, service contracts and interact with IT management on a regular basis
• Propose and plan information security strategy, yearly plans, inline to regulatory, compliance requirements and key risk areas for the bank
• Establish accountability to ensure controls are implemented to mitigate the risk and also mentor and guiding Internal teams, IT, IT Security, IT Development, Business toward improving CBD security posture
• Developing and maintaining information security policies. Other activities include Maintain risk register, provide monthly management dashboard with KPI status,
• Perform security review of new projects and project changes, Lead and manage Application security assessment teams and reporting staff
• Act as key technical resource in a number of important CISO Office activities, including Application Security Risk Assessments, Security Compliance Reviews and Independent Security Assessments

• Establish an information security governance framework
• Document review and update information security policies to protect bank and its sensitive data while ensuring compliance with relevant regulations
• Break complex security requirements in easy-to-understand action plans for management
• Tracking and closing security concerns with IT, Business Owners
• Provide management dashboards showing progress on compliance and security KPI
• Support management in developing a security strategy
• Manage Swift and NESA/UAE IA compliance management programs
• Perform Enterprise Risk assessment, Cloud risk assessment
• Perform Vendor/Third party risk assessment inline to information security risks
• Review information security risk acceptance requests
• Provide security awareness training for new joiners
• Conduct compliance review of regulatory requirements to identify gaps and action plan
• Review and Approve changes on business applications security changes
• Represent information security in various meetings
• Develop business cases for special security engagements
• Manage penetration testing and vulnerability assessment activities
• Act as SME for security decisions, regularly reviewing security metrics, preparing reports and dashboards
• Present application security gaps and prepare reports on findings and recommendations
• Manage and evaluate application security testing activities for possible vulnerabilities
• Ensure that identified risk is managed in accordance with the IT Risk Management program by regular review and follow up
• Conduct Application security risk assessments and independent assessments (penetration testing), including risk modelling, analysis and mitigation
• Manage and development of appropriate information security policies, standards, procedures, checklists, and guidelines using generally – recognized security concepts tailored to meet the requirements of the organization
• Creation of necessary documentation that codifies the Application…