JOB PURPOSE:

Formulate and implement a forward-thinking strategic risk management framework that aligns with the organization's long-term objectives including identifying, assessing, and mitigating strategic risks to safeguard the organization's reputation, financial stability, and sustainable growth.

KEY ACCOUNTABILITIES:

Risk Assessment

Conduct risk assessments within the organization's Digital/OT cybersecurity including identifying and evaluating potential IT/OT risks and vulnerabilities that could impact the organization's strategic objectives, financial stability, and overall performance.
Model hypothetical scenarios that could pose significant risks to the organization and develop strategies to mitigate these risks.
Assess risks accurately and provide actionable recommendations in helping the organization make informed choices and interventions.
Collect evidence for relevant risks controls implementations.

Strategic risk management framework

Implement a strategic risk management framework to address identified risks in a systematic and proactive manner, aligning risk mitigation strategies with the organization's long-term goals.
Prepare annual plan and demands for relevant IT/OT Risk Management and compliance.
Report on Digital/OT Cybersecurity risks, compliance actions, and treatment plan.
Work closely and Support the ERM team for management of risks and their controls in ERM register.
Perform the role of Risk Champion for Digital Division as part of Corporate and Group ERM processes.
Setup and manage governance structures to manage risk profile and cybersecurity scorecards.
Manage risk reporting and communication at levels in Group Company and HQ.

Compliance monitoring

Monitor and assess compliance with relevant laws, regulations, and industry standards. Develop and maintain a compliance framework that aligns with leading practices.
Stay updated on changes in relevant regulations and standards that may impact the organization’s operations and ensure timely adjustments to compliance procedures.
Work closely with ADNOC HQ/Group Digital to develop, enhance, and maintain compliance programs, policies, procedures, and guidelines that align with industry leading practices and regulatory requirements.
Implement and utilize relevant compliance monitoring tools and technology to automate compliance checks, streamline reporting, and enhance the efficiency of compliance monitoring processes.
Monitor compliance of third-party vendors, suppliers, and partners to ensure they meet relevant organization’s standards and regulatory requirements.
Develop and maintain a relevant due diligence process for onboarding and monitoring third-party relationships.
Track Cybersecurity controls implementation in liaison with local functions, Shared Services and Group Digital, along with their evidence.
Conduct OT Cybersecurity compliance review.

Monitoring Key Risk Indicators (KRIs):

Identify and track key risk indicators (KRIs) that are relevant to compliance and can serve as early warning signs for potential compliance issues.
Develop a system for relevant regular KRI reporting and analysis and initiate appropriate actions in response to deviations from expected compliance levels.

Security and compliance training and awareness:

Organize and facilitate compliance training programs and awareness campaigns for employees, contractors, and relevant stakeholders to promote a culture of relevant compliance.
Ensure employees understand their relevant compliance responsibilities and obligations.
Conduct awareness sessions for users in any aspects of Cybersecurity and Information Assets Protection.
Support in design and provision of different awareness / training contents.
Analyse effectiveness of provisioned awareness / trainings.

Incident reporting and response:

Supporting the relevant process for reporting and follow ups for compliance violations, incidents, or breaches.
Implement incident response plans to address relevant compliance violations promptly and effectively, ensuring proper documentation and corrective actions.
Work closely and support SOC, VMS and Red teams for handling and follow up of reported incidents.

Regulatory liaison:

Where necessary, maintain positive relationships with regulatory authorities and external bodies, ensuring or supporting timely and accurate submission of required compliance documents and information.

Compliance culture advocacy:

Act as an advocate for a strong compliance culture within the organization, emphasizing the importance of ethical conduct, integrity, and adherence to compliance standards at all levels of the organization.

Projects and KPI Management:

Manage and track relevant projects in liaison with local functions, Shared Services and Group Digital.
Communicate, Support and Coordinate with stakeholders during relevant Group Digital Cybersecurity projects activities.
Engage in relevant scoping, technical evaluation and call off orders.
Plan, supervise and coordinate relevant activities to meet functional and group objectives and KPIs.

Business Continuity Management:

Prepare relevant annual DR Drill plan and demands for Digital Business Continuity Management in liaison with local functions, Shared Services and Group Digital.
Work closely with local functions, Group Digital and Shared Services to identify relevant potential impacts of various disruptions / incidents and disaster scenarios and contribute to making recommendations.

QUALIFICATIONS, EXPERIENCE, KNOWLEDGE & SKILLS:

Minimum Qualification

Bachelor’s degree in computer science, engineering, information security or equivalent

Minimum Experience & Knowledge & Skills

10 years of experience in IT/OT risk management, security governance, audit projects
Proven capability in International Standards such as ISO 27001, ISA/IEC 62443, CSA, COBIT, CIS, Cybersecurity Standards, NIST, etc.
Certification in at least one of the following: CGEIT, CISSP, GICSP, CCSK, CISA+CISM
Good technical competencies and exposure to IT/OT application or infrastructure development, support, and management of PLC, DCS, SCADA systems.

2552

ADNOC Group

New Jobs

Specialist, Risk & Compliance (IT Sec.)