Cybersecurity Director

1. Cybersecurity Strategy and Governance • Develop and execute the technical cybersecurity operations roadmap aligned with organisational security policies and industry standards. • Implement security controls and standards defined by the Information Security Governance function. • Maintain clear segregation of duties between first-line security operations and second-line security governance. • Provide technical cybersecurity risk assurance to the VP of Digital & Technology and relevant governance stakeholders. • Embed security-by-design principles across technology initiatives. 2. Network and Infrastructure Security • Oversee the design, implementation, and operation of network security controls, including firewalls, network segmentation, NAC, VPN, IDS/IPS, secure remote access, web and email gateways, and DDoS protection. • Lead the cybersecurity team responsible for network and infrastructure security. • Enforce secure network architecture and Zero Trust principles. • Ensure security hardening, baseline configurations, and continuous compliance across servers, endpoints, cloud platforms, and OT/IoT environments. 3. Security Operations Centre (SOC) and Threat Management • Direct 24/7 security monitoring, threat detection, investigation, and triage through the SOC. • Oversee security technologies and capabilities, including SIEM, EDR/XDR, SOAR, and threat intelligence. • Develop and continuously improve detection rules, use cases, and monitoring processes to reduce false positives and improve threat detection and response times. • Lead proactive threat hunting and adversary emulation activities to assess the resilience of the technology environment. 4. Identity and Access Management and Application Security • Oversee Privileged Access Management (PAM), identity and access controls, and joiner-mover-leaver processes in collaboration with IT. • Ensure appropriate access controls and privileged account security. • Integrate application security throughout the Software Development Life Cycle (SDLC). • Oversee secure code reviews, SAST/DAST, API security, and DevSecOps practices. 5. Vulnerability, Patch and Configuration Management • Manage the enterprise vulnerability management lifecycle, including discovery, risk-based prioritisation, remediation tracking, and reporting. • Coordinate vulnerability remediation, patching, and secure configuration management with IT operations. • Ensure security exposures are addressed within agreed service-level agreements (SLAs). • Monitor remediation progress and escalate outstanding critical vulnerabilities and security risks. 6. Cyber Incident Response and Resilience • Lead technical cyber incident response, covering preparation, detection, containment, eradication, recovery, and post-incident reviews. • Develop, maintain, and regularly test incident response playbooks and procedures. • Conduct tabletop exercises to assess incident readiness and response effectiveness. • Ensure timely incident escalation and coordinate regulatory notifications with the Information Security Governance function. • Contribute cybersecurity requirements to business continuity and disaster recovery planning. 7. Compliance, Audit and Security Reporting • Ensure the operational effectiveness of technical security controls and provide evidence for internal and external audits and regulatory assessments. • Establish and monitor cybersecurity Key Performance Indicators (KPIs), Key Risk Indicators (KRIs), and management dashboards. • Report security operations performance, risks, incidents, and remediation progress to leadership and governance stakeholders. • Ensure security incidents, control exceptions, and risks are documented, escalated, and remediated to closure. 8. Team Leadership and Development • Lead, develop, and retain a multidisciplinary cybersecurity team covering network security, security operations, and identity and access management. • Set team objectives, manage performance, and promote continuous professional development. • Build a high-performance team and support an Emiratisation-aligned talent pipeline. • Foster a culture of security awareness, accountability, and continuous improvement. 9. Budget, Vendor Management and Continuous Improvement • Support the preparation and management of the cybersecurity operations budget. • Ensure cost-effective utilisation of cybersecurity tools, services, and resources in line with procurement policies. • Manage cybersecurity vendors, managed service providers, and technology partners against agreed SLAs and performance outcomes. • Evaluate emerging cyber threats, security technologies, and industry practices to continuously strengthen the organisation’s security posture. Regulatory and Technical Frameworks • UAE Information Assurance Standards • NIST Cybersecurity Framework (CSF) 2.0 • ISO 27001 Technical Expertise • Network and infrastructure security • Security Operations Centre (SOC) management • SIEM, EDR/XDR, SOAR, and threat intelligence • Firewalls, IDS/IPS, NAC, VPN, and network segmentation • Cloud, endpoint, server, and OT/IoT security • Identity and Access Management (IAM) and Privileged Access Management (PAM) • Application security, SAST/DAST, API security, and DevSecOps • Vulnerability, patch, and configuration management • Cyber incident response, threat hunting, and cyber resilience • Security compliance, audit, risk reporting, and control assurance • Vendor, budget, and cybersecurity team management