Director, Cyber Security Risk Governance

This role ensures that cyber security risks to etisalat critical infrastructure, revenue-generating services, and sensitive data are effectively identified, assessed, governed, and communicated, in alignment with the business objectives, regulatory requirements, and international standards. The position provides strategic leadership and direction to strengthen the etisalat resilience against cyber threats and support the organization’s digital ambitions.

Responsibilities

• Develop, implement, and continuously enhance the Cyber Security Risk Governance framework, policies, and standards in line with e& business strategy, regulatory obligations, and leading international practices (e.g., ISO 27001, NIST, etc.).
• Establish and maintain risk appetite, risk tolerance levels, and governance mechanisms for cyber security.
• Oversee the identification, assessment, analysis, and prioritization of cyber risks across Etisalat’s critical infrastructure.
• Ensure that appropriate risk treatment plans, controls, and mitigation strategies are defined, implemented, and monitored to protect critical assets and services from cyber threats and attacks.
• Ensure adherence to applicable national regulations, telecom and sector-specific requirements, and relevant international standards related to cyber security risk management.
• Define and govern risk-based cyber security policies, procedures, and control frameworks to maintain compliance and reduce residual risk to acceptable levels.
• Lead and coordinate cross-functional teams to drive a unified approach to cyber security risk governance.
• Promote consistent risk management practices, fostering collaboration and alignment between technical teams, business units, and support functions.
• Translate complex cyber security risks into clear, concise business terms for Senior Management and key stakeholders, enabling informed decision-making.
• Periodically present the e& Cyber Security Risk Profile to the senior management.
• Drive continuous improvement initiatives in risk assessment methodologies, governance processes, and reporting mechanisms to enhance overall cyber resilience.
• Lead, mentor, and develop the Cyber Security Risk Governance team, ensuring that the function has the necessary skills, capabilities, and tools to perform effectively.
• Foster a strong risk-aware and security-conscious culture across the organization through guidance, awareness, and engagement with stakeholders.
• Monitor and analyze global cyber security trends, threats, and regulatory requirements to inform strategic decisions.
• Detailed understanding of security architecture / design best practices, processes, risk assessment, planning, project management, documentation and presentation.
• Must possess the ability to conduct risk assessments of services including identification of threats, threat actors, vulnerabilities and their impacts.
• Conduct comprehensive risk assessments to identify all issues and track them via implementing risk management methodologies.
• Understand, develop, support, and apply a risk management framework in projects.
• Perform security gap-analysis across projects, applications and vendors, documenting remediation plans.

Qualifications

• Bsc. in Cyber Security / Computer Engineering
• CISSP, CRISC
• Hands-on experience in developing policies, standards and guidelines.
• Possess knowledge of various telecom and IT standards such as ITU, ETSI, ISO, SIA, GSM, 3GPP, etc.
• Possess knowledge of various security OEM technologies and controls including but not limited to GRC, UTM, IPS/IDS, WAF, SIEM, IAM, PAM, DDoS, AEP, NDR, EDR, etc.
• Must have excellent communication and presentation skills.