Head of Cyber Security

The Head of Cyber Security leads Keolis-MHI’s (KM) enterprise‑wide information security and cybersecurity management program, ensuring the comprehensive protection of both IT (Information Technology) and Rail OT (Operational Technology) environments. This role encompasses implementing, maintaining, and continually improving the ISO 27001:2022 standard while ensuring compliance with data privacy regulations, notably UAE Law No. 45 of 2021. A key focus is bridging IT and Rail OT cybersecurity to safeguard the critical infrastructure of RTA Dubai Metro and Dubai Tram.

The Head of Cyber Security ensures the CSMP functions as a strategic framework for defining, prioritizing, and aligning cybersecurity initiatives with organizational and regulatory objectives, fostering a proactive security culture across KM’s operations.

• Enhance and oversee the implementation of the information security management framework, incorporating ISO 27001:2022 standards, data protection regulations, and GRC principles, while aligning Rail OT and IT security strategies with KM's organizational goals.
• Collaborate with leadership to develop and maintain a comprehensive cybersecurity and data privacy roadmap that supports KM's strategic goals and ensures regulatory compliance.
• Lead the implementation, maintenance, and continual improvement of the ISO 27001:2022 standard within the Dubai Metro Business ICT environment; this involves defining and managing the information security management system (ISMS) processes in alignment with business objectives to ensure the confidentiality, integrity, and availability of information assets.
• Ensure KM's compliance with UAE Federal Decree‑Law No. 45/2021 on the Protection of Personal Data. Serve as the primary point of contact for data protection matters, evaluating and enhancing the data protection framework to maintain robust privacy practices across all operations.
• Provide guidance on data protection compliance, ensuring alignment with local and international regulations, and fostering a culture of data privacy within the organization.
• Oversee the effective utilization of Nozomi Networks IDS and the ELK Stack‑based SIEM for proactive monitoring and threat detection in Rail OT systems.
• Collaborate with the SECOPS Team to ensure alignment of maintenance‑related cybersecurity tasks with organizational goals and the Maintenance Plan Table (MPT).
• Ensure the integration of CSMP activities into the organization’s broader information security framework and oversee their effective execution to align with RTA’s objectives and compliance requirements.
• Regularly review progress on CSMP initiatives, identify potential gaps, and implement corrective actions to ensure objectives are achieved within agreed timelines.
• Continuously review and align the CSMP objectives with emerging cybersecurity trends, technological advancements, organizational changes, and evolving RTA regulations to maintain a forward‑looking security strategy.

• Manage and optimize information security, cybersecurity, data protection, and GRC budgets, ensuring cost‑effectiveness and alignment with KM's financial strategies.
• Lead financial planning and resource allocation for cybersecurity, data protection, and GRC initiatives, ensuring adequate investments in IT and Rail OT‑specific projects, ISO 27001:2022 certification maintenance, and compliance with data privacy laws.
• Define, review, and manage the cybersecurity budget for conducting Vulnerability Assessments (VA), Penetration Tests (PT), Privacy Impact Assessments (PIA), and other cybersecurity activities (including threat intelligence, incident response, and consultancy services) with the support of the KM Finance Business Partner team.

• Act as the primary cybersecurity liaison, DPO, and GRC leader, fostering strong relationships with internal teams, RTA, and external stakeholders. Provide expert guidance on cybersecurity, Rail OT security, and data protection in compliance with UAE Law No. 45 of 2021.

• Oversee the tactical implementation of cybersecurity, data protection, and GRC strategies,…