Information Security Architect
Job Type: 6 months contract, on-site Abu Dhabi Yas Island
Overview
To support our continued growth and expansion we require an interim Information Security Architect that has proven experience in delivering security outcomes for critical new projects, business change initiatives, and integrations with business partners.
Responsibilities
Security design & technical controls
• Provide input into the design and implementation of technical security controls for new projects, critical systems, applications, and integrations.
• Collaborate with Product engineering, technical operations, and business teams to design secure solutions that align with project objectives and organizational security policies.
• Ensure security controls are effectively integrated into the DevOps pipeline and CI/CD processes.
• Directly support the implementation of security controls, including firewalls, access controls, encryption, and monitoring systems, for immediate project needs.
Cloud Security Architecture
• Support the design and implementation of secure cloud-based architectures for new services and solutions, focusing on scalability and data protection.
• Provide subject matter expertise in configuring and securing cloud environments, ensuring compliance with relevant standards (e.g., ISO 27001, NIST).
Security assessment for change initiatives
• Conduct security impact assessments for new & existing change initiatives to identify security risks and recommend controls that align with compliance and business objectives.
• Ensure that all changes to systems and processes maintain adherence to security best practices and industry standards
• Define and document security controls for specific projects and systems, including access management, data protection, and incident response.
Secure integration with business partners
• Oversee the secure integration of third-party systems, applications, and services as part of new business partnerships and expansion efforts.
• Evaluate partner security frameworks and provide guidance to ensure compliance with contractual and regulatory security requirements.
Security testing & remediation
• Scope and facilitate security testing activities (e.g., penetration testing, vulnerability assessments) with independent testers, ensuring alignment with project timelines and objectives.
• Analyze results from security testing, identify remediation actions, and work with technical teams to address findings effectively.
Risk assessment & mitigation strategies
• Conduct gap analyses of security controls, configurations, and processes for specific projects.
• Perform risk assessments to identify vulnerabilities, threats, and impacts, recommending appropriate mitigation strategies.
• Document risks and gaps in a formal risk register and report findings to the Infosec Director and project stakeholders.
• Provide actionable recommendations to enhance security controls, address identified gaps and improve overall security posture.
Regulatory compliance & data protection
• Ensure system architecture and technical controls implementations align with regulatory requirements (e.g., ISO 27001, PCI DSS, NIST CSF, UAE data protection law)
• Support data protection efforts by mapping and classifying sensitive data across systems involved in projects.
• Embed data protection principles, such as privacy by design and default, into system designs and processes
• Define and implement logging, monitoring, and controls to detect and respond to unauthorized data access or breaches.
Knowledge transfer and documentation
• Develop detailed documentation for all deliverables, including security designs, technical controls, gap analyses, risk assessments, and testing results for each project.
• Conduct knowledge transfer sessions with the security team, ensuring a seamless handover of responsibilities and ongoing management of security practices
• Provide regular updates to project stakeholders and the Infosec Director, highlighting progress, risks, and next steps.
Qualifications:
One or many of these qualifications are preferred.
• Bachelor’s or master’s degree in information technology, Computer Science, Cyber Security, IT Architecture or Software Engineering related field
• Certified Cloud Security Professional (CCSP)
• Certified Information Systems Security Professional (CISSP)
• Microsoft Certified: Azure Security Engineer Associate
• Microsoft Certified: Azure Solutions Architect Expert
• CompTIA Cloud+
• Microsoft Certified: Cybersecurity Architect Expert
• Certified Information Security Manager (CISM)
• Certified Ethical Hacker (CEH)
• TOGAF
• 1SO27001 Lead Implementer or Lead Auditor
Experience Requirements:
• 5-10 years of hands-on experience designing and implementing security architectures within cloud-based environments.
• Demonstrated ability to deliver security solutions for time-sensitive projects, integrations, or business-critical change initiatives.
• Experience in working within environments requiring rapid assessment and remediation of security gaps.
• Proven experience in information security, IT infrastructure, or cloud architecture roles with a focus on securing cloud environments, ideally Azure
• Demonstrated ability to implement security controls for cloud services, including identity management, access control, encryption, and monitoring
• Hands-on experience with Azure security features, including Azure Active Directory (Azure AD), Azure Security Center, Azure Key Vault, Azure Firewall, Network Security Groups (NSGs), and Virtual Network (VNet) configurations to secure cloud environments
• Skilled in conducting risk assessments of cloud architectures, identifying vulnerabilities, and implementing remediation strategies within Azure environments.
• Proven track record of collaborating with IT, DevOps, application development, and security teams to embed security controls within cloud environments.
• Experience securing third-party integrations and partnerships, including vendor risk assessments and ensuring secure data exchanges.
• Experienced in facilitating penetration testing, vulnerability assessments, and remediation planning in collaboration with independent testers.
• Strong understanding of risk management methodologies and the ability to identify, document, and mitigate risks proactively.
• Experience embedding security within DevOps pipelines, ensuring continuous delivery workflows incorporate secure practices.
Skills Requirements:
• Expertise with firewalls, IDS/IPS, SIEM platforms, endpoint protection tools, and vulnerability management solutions.
• Familiarity with cloud-native security tools (e.g., Azure Security Center, AWS GuardDuty)
• Proficient in implementing secure configurations for operating systems, networks, and applications, following industry standards (e.g., CIS Benchmarks).
• Skilled in developing security policies, procedures, and reference architectures tailored to specific projects and organizational needs.
• Familiarity with technical compliance & governance frameworks such as NIST CSF, PCI DSS, and ISO 27001.
• Deep understanding of regulatory requirements, including data privacy, cross-border data transfers, and secure handling of sensitive data.
• Proven ability to collaborate with cross-functional teams, including development, operations, legal, compliance, and external vendors.
• Skilled in translating complex security requirements into actionable steps that align with business objectives.
• Strong technical writing skills to create detailed documentation, including security designs, risk assessments, and remediation plans.
• Ability to prepare executive-level reports and presentations for leadership.
