Abu Dhabi Islamic Bank
Technical Assurance Manager
- Compensation
- Not disclosed
- Location
- United Arab Emirates
- Work setup
- Not specified
- Seniority
- Not specified
- Employment
- Not specified
- Experience
- Not specified
- Category
- Not specified
- Posted
Skills
Must have
- Deep expertise in second-line technical assurance and evidence-based assessment across infrastructure, applications, databases, cloud, networks and security platforms.
- Strong knowledge of control design and operating-effectiveness assessment.
- Working knowledge of major information security, cybersecurity and regulatory control frameworks.
- Strong technical risk assessment, evidence evaluation, documentation, stakeholder management and executive reporting skills.
- Bachelor’s or master’s degree in information security, cybersecurity, engineering, computer science, IT or a related discipline.
Nice to have
- Knowledge of NIST SP 800-53A and NIST SP 800-115 assessment principles.
- Familiarity with ISO/IEC 27001, NIST CSF, PCI DSS, SWIFT CSCF, UAE Information Assurance and CBUAE requirements.
- Practical experience with automated compliance, continuous assurance, technical telemetry, configuration evidence and security-platform data.
- Understanding of penetration testing, vulnerability assessment, Red/Purple Team methods, MITRE ATT&CK, OWASP, PTES and CIS Benchmarks.
- Knowledge of IAM/PAM, SIEM/SOC, DLP, cryptography, certificate management, CSPM/CASB, WAF, DDoS and endpoint security.
- Understanding of cyber resilience, recovery controls, dependency validation, recovery integrity and resilience-testing evidence.
- Relevant certifications such as CISA, CISSP, CRISC, CISM, OSCP, GPEN, GIAC or PCI ISA/QSA; combined assurance and technical credentials are preferred.
Full description
- Role : Technical Assurance ManagerLocation : Abu Dhabi
Role Purpose:
Lead ADIB’s second-line technical security assurance across infrastructure, applications, databases, cloud, networks, security platforms and critical business services. The role owns the risk-based Technical Assurance Plan, methodologies and tools; provides evidence-based conclusions on control design, implementation, compliance and operating effectiveness; leads technical regulatory assurance, Red Team assurance and cyber resilience assurance; and independent challenges, reports, retests and validates remediation. First-line functions remain accountable for the control ownership, operation and remediation. While this role operates from a second line assurance level
Key Accountabilities of the role
- Develop and execute a risk-based annual assurance plan covering critical services, technologies, controls and relevant third parties.
- Maintain the assurance universe and prioritize reviews using criticality, threats, regulatory obligations, change, incidents and prior findings.
- Independently test control design, implementation, compliance and operating effectiveness using evidence-based methods.
- Own assurance methodologies, test scripts, sampling and evidence standards, aligned with NIST, ISO 27001, PCI DSS, SWIFT CSCF, UAE and CBUAE requirements.
- Operate assurance tools and expand automated or continuous monitoring to identify control drift, gaps and non-compliance.
- Assess findings by likelihood, exploitability, impact, criticality and compensating controls; align ratings with the Enterprise Risk Framework.
- Lead second-line technical assurance for regulatory and industry obligations, maintaining traceability from requirements to controls and evidence.
- Define and govern threat-informed Red Team exercises; coordinate specialist execution and validate preventive, detective, response and recovery controls.
- Use penetration-testing and vulnerability results as assurance evidence, avoiding duplication of first-line specialist testing.
- Assure cyber resilience, recovery integrity, security-control survivability, crisis simulation, dependency mapping and applicable RTO/RPO evidence required for Cyber security and privacy
- Assess AI/ML and AI-enabled technologies, including access, data protection, integration security, monitoring, prompt/output integrity and adversarial testing.
- Own the finding lifecycle from evidence validation and risk rating through escalation, independent retesting and closure.
- Provide assurance validation to projects and technology change without assuming first-line control ownership inline with assurance plan