Consultant –GRC

Role Overview

Policy and Compliance

• Support Information Security policies, standards, procedures, guidelines and templates aligned with ADHICS, ISO/IEC 27001 and applicable requirements.
• Execute compliance assessments, gather evidence and document operational capability and control effectiveness.

Risk and Audit

• Conduct risk assessments, maintain risk registers and track treatment actions under senior guidance.
• Support internal and external Information Security audits by preparing evidence and tracking findings to closure.

Stakeholder and Reporting

• Coordinate with business functions, sector stakeholders and regulatory bodies on security matters, deviations, exemptions and incidents.
• Support awareness and training activities and maintain GRC documentation, trackers and reports.

Experience and Education

• Minimum of 5 years in GRC and Information Security, including cybersecurity, technology risk, regulatory compliance or audit support.
• A demonstrable portion of experience must be in the UAE healthcare sector or a healthcare regulatory environment.
• Hands-on exposure to implementing, assessing or supporting compliance against ADHICS is required.
• Bachelor’s degree in IT, Cybersecurity, Computer Science, Risk Management, Business Administration or a related field.

Skills and Certifications

• Working understanding of GRC processes, control frameworks, risk assessment methods and compliance monitoring.
• ADHICS knowledge and familiarity with UAE healthcare regulatory and Information Security requirements are required.
• Preferred certifications include ISO/IEC 27001 Lead Implementer or Lead Auditor, CRISC, CISA, CISSP or equivalent.
• Foundational certifications such as ISO/IEC 27001 Foundation and CompTIA Security+ are advantageous.
• Important competencies include analytical skills, stakeholder communication, collaboration, attention to detail, integrity and confidentiality.