Lead Consultant- GRC

Role Overview

Workstream Delivery

• Own end-to-end delivery of assigned GRC and Information Security workstreams and act as senior client and regulatory stakeholder contact.
• Plan activities, set technical direction and quality standards, manage risks and dependencies and ensure milestones are met.

Policy and Risk

• Lead development, implementation and continuous improvement of Information Security policies, standards, procedures, guidelines and templates.
• Lead risk identification, assessment, treatment and monitoring and escalate significant risks with remediation recommendations.

Compliance and Audits

• Define and execute compliance initiatives and lead Information Security audits.
• Assess operational capabilities, compliance and control effectiveness and track findings through closure.

Stakeholder and Team Leadership

• Serve as senior liaison with business functions, sector stakeholders and regulatory bodies on security matters.
• Guide and quality-assure consultants and junior team members through technical direction, coaching and feedback.
• Provide expert advisory on agreements and represent Information Security on committees and forums.

Experience and Education

• Minimum of 9 years in GRC and Information Security, including leadership of GRC workstreams or teams and quality assurance of deliverables.
• A substantial portion of experience must be in the UAE healthcare sector or a healthcare regulatory environment.
• Experience must include cybersecurity, technology risk, regulatory compliance or audit management and hands-on ADHICS work.
• Bachelor’s degree in IT, Cybersecurity, Computer Science, Risk Management, Business Administration or a related field.
• A Master’s degree or relevant postgraduate qualification is preferable.

Skills and Certifications

• Advanced GRC, control framework, risk assessment and compliance monitoring knowledge with the ability to lead workstreams.
• In-depth working knowledge of ADHICS and UAE healthcare regulatory and Information Security requirements is mandatory.
• Preferred certifications include CISSP, CISM, CISA, CRISC, ISO/IEC 27001 Lead Implementer or Lead Auditor, ISO 31000 Risk Manager or CGEIT.
• Important competencies include delivery leadership, quality assurance, stakeholder management, mentoring, communication, integrity and confidentiality.