AVP-Information Security Compliance.Information Security Group-ISG

Information Security Compliance & Governance Leadership

Hold overall responsibility for information security compliance governance within Information Security.

Define, maintain, and govern information security policies, standards, and compliance requirements across regions.

Provide structured second‑line oversight across governance, risk, and compliance to ensure consistency, traceability, and defensibility of controls.

Support Global ISG Governance and operational alignment mechanisms.

Regulatory & Audit Readiness

Act as the central coordination point for information security regulatory examinations, supervisory interactions, and internal/external audits.

Ensure timely, accurate, and defensible regulatory and audit responses, including evidence management, issue remediation tracking, and senior management reporting.

Maintain continuous regulatory readiness by embedding compliance assurance into BAU processes rather than point‑in‑time activity.

Regulatory Compliance & Assurance

Oversee compliance with all regulatory requirements related to information security across multiple jurisdictions.

Maintain and govern the Information Security regulatory obligations register, ensuring completeness and accuracy.

Manage the regulatory calendar and ensure timely execution of all compliance and assurance activities.

Govern security exception management, ensuring exceptions are documented, risk‑assessed, approved, monitored, and tracked to closure.

Support key regulatory programs and certifications (e.g., PCI‑DSS, SWIFT‑CSP, NESA IAS) from a second‑line oversight perspective.

Govern and support all regulatory submissions, ensuring accuracy, consistency, and data integrity from Security and Technology teams.

Monitor compliance with regulator‑mandated frameworks across regions, including (but not limited to) NESA, SWIFT‑CSP, PCI‑DSS, DFS500, FFIEC, HKMA‑CRAF, and country‑specific cyber security frameworks (India, Kuwait, Egypt, etc.).

Provide annual Information Security compliance updates to the Board (e.g., NESA IAS reporting as mandated by CBUAE).

Act as liaison with regulators and government entities to support the Bank’s information security agenda.

Govern the IS Regulatory Watch Forum and escalate emerging regulatory risks and changes to senior management.

Compliance Risk Oversight and Assurance

Oversee identification, assessment, and reporting of information security compliance risk.

Drive consistent control design, assurance approaches, and issue management across the Three Lines of Defence.

Provide senior management with transparent insight into compliance risk posture and emerging thematic issues.

Centre of Excellence (CoE) Leadership and Capability Building

Lead the Information Security Compliance Centre of Excellence, acting as the authoritative point for compliance interpretation and best practices.

Build and sustain T‑shaped expertise within the CoE, combining depth in information security compliance with breadth across IS GRC disciplines.

Drive standardization, reuse, and continuous maturity uplift of compliance and assurance processes.

Stakeholder Engagement and Governance Forums

Own and manage ISG governance forums related to information security compliance and assurance.

Engage proactively with senior stakeholders across ISG, Risk, Compliance, Legal, Technology, and Internal Audit.

Influence decision‑making on compliance priorities, remediation strategies, and governance decisions impacting regulatory posture and security risk exposure.

Navigating the Evolving Threat and Regulatory Landscape

Monitor and assess emerging cyber threats, regulatory developments, and industry trends impacting information security compliance.

Translate evolving threats and regulatory expectations into practical governance, policy, and control enhancements.

Enable proactive, intelligence‑driven compliance approaches that strengthen the Bank’s security posture and resilience.

General Management & Oversight

Maintain and present the progress of Information Security Compliance roadmap to the VP of Information Security & Head of IS GRC on regular basis.

Support ISG vision, mission, and key initiatives across the organization.

Manage IS GRC Run-the-Bank and Change-the-Bank agendas to deliver results on time and within budget.

Ensure readiness for regulatory examinations and audits, avoiding critical findings.

Drive timely closure of all legal, regulatory, and audit issues with required quality standards.

Alignment with Business Priorities: Ensure all actions and decisions support the organization’s strategic objectives and business goals.

Ownership and Accountability: Take full responsibility for outcomes, fostering accountability within the team and across all deliverables.

Focus on Outcomes and Impact: Deliver measurable results that enhance the bank’s security posture and promote a strong security culture.

Regulatory trust and defensibility over checklist compliance

Independent judgment with collaborative execution

Innovation and Automation: Continuously seek innovative approaches and leverage automation to improve efficiency and effectiveness.

Measurable impact on risk reduction and security posture

Continuous Learning and Improvement: Commit to ongoing learning, adapting to emerging challenges, and improving processes and performance.

HO (Head Office) and International Regulators and Supervisors across the bank is operating.

Information Security / Cyber Security Regulations and Industry best practices.

All business units including LOD 1-3 including LOD1 – Business, Tech GRC, Technology, LOD-2 Group Compliance, Fraud Prevention, Risk Management and LOD-3 Internal Audit.

Address complex and ambiguous regulatory and compliance challenges across jurisdictions.

Balance regulatory expectations, security risk, and operational realities to deliver sustainable outcomes.

Resolve conflicts between control requirements and execution constraints through structured governance and influence.