Job Purpose
At Emirates, we believe in connecting the world to and through our global hub in Dubai and in constantly innovating to ensure our customers ‘Fly Better’. Emirates Group IT thrives on the dynamic nature of technology. Being pioneers in aviation innovation, we're always at the forefront, pushing boundaries. We're on the lookout for exceptional IT professionals to fortify our position as leaders in the industry. Embark on a journey with the world’s largest international airline and become a vital part of our cutting-edge information and technology team as a Senior CyberSecurity Assurance Analyst.
Join our CyberSecurity team where we ensure a world class CyberSecurity organisation based on the key principles of People, Process and Technology underpinned with executive endorsement of a multi-year strategy to continuously improve and develop. The team protects our digital assets by monitoring for threats, responding to incidents, managing vulnerabilities, and ensuring compliance with security policies and regulations. If you are passionate about CyberSecurity, we invite you to apply to play a crucial role in shaping the future of our technology initiatives at Emirates Group.
As a Senior Cyber Assurance Officer in the Cyber Assurance team, you will develop, implement, lead and continuously improve the security verification and testing processes consisting of but not limited to risk assessments, compliance reviews, vulnerability assessments and penetration tests based on industry best practices and as defined by the assurance. Collaborate with the team in developing the assurance program on an ongoing basis to incorporate industry best practices and offensive and defensive attack techniques.
In This Role You Will
- Represent cybersecurity assurance capabilities within the agile process as well as drive Cybersecurity best practices across the Emirates Group by executing in-depth automated and manual discovery of security vulnerabilities in web applications, mobile applications, web services and client-server applications and associated infrastructure.
- Research, recommend and implement formal methodologies and tools for conducting technical cybersecurity risk assessments, reviews and investigations. Perform impact analysis to achieve the security-by-design objective.
- Monitor and continuously review the Emirates Group systems on an ongoing basis, in compliance with the Emirates Group Cybersecurity Policies, principles and standards. Initiate corrective actions in the event of any violations to aid effective risk-based decision-making supported with data.
- Plan and schedule regular vulnerability assessments, penetration tests, technical risk assessments and compliance reviews on the Groups key IT infrastructure components and applications based on the criticality and perceived risk of the applications/services.
- Ensure all the identified security weaknesses and risks are managed through their life cycle via product backlogs to ensure development teams have a clear prioritization or can triage issues on a timely basis by providing knowledge transfer to the agile teams using meetings, walkthroughs, technical discussions, etc.
- Develop documentation and a knowledge base to be used by developers for implementing secure coding practices and provide recommendations for missing application and infrastructure security controls to facilitate a secure design culture.
- Provide necessary knowledge transfer of the vulnerabilities found during the assessments to the software engineering teams using meetings, walkthroughs, technical discussions etc. for implementing appropriate security fixes.
- Collaborate with development teams on improving security by offering design reviews, threat modelling, awareness, training, new tooling and expert review.
- Create tools, scripts, and automation to make the vulnerability discovery and vulnerability management process more consistent, and repeatable and increase efficiency.
Qualification
Qualifications & Experience
- Degree or Honours (12+3 or equivalent) in a relevant field such as Computer Science, Computational Mathematics, Computer, Engineering or Software Engineering.
- 5+ years in IT Security related industry with recognized certification such as CISSP, CISA, CISM, GIAC certification, CEH etc.
Knowledge & Skills Required
- Strong understanding of network protocols, system architectures and related security technologies.
- Extensive experience in technical risk assessments and providing risk mitigation recommendations.
- Excellent communication skills for conveying complex security issues to diverse stakeholders.
- Strong fundamentals of OS, Network devices, databases and programming Concepts.
- Proficient in using and implementing open-source and commercial tools for applications, mobile, and thick client security testing.
- Experience building tools and automation to discover vulnerabilities at scale.
- Knowledge of reviewing mobile and web-based security design, security implementation and review.
- Penetration Tester (GWAPT), and Certified Information Systems Security Professional (CISSP).
- Deep technical knowledge of browser security controls such as SOP, CSP, XFO, HSTS, etc
- Strong skills in running vulnerability discovery and vulnerability management processes.
- Experience in auditing designs of technical implementation of infrastructure security components.
Leadership Role: No
Salary & Benefits
Join us in Dubai and enjoy an attractive tax-free salary and travel benefits that are exclusive to our industry, including discounts on flights and hotels stays around the world. Find out what it’s like to live and work in our fast-paced, cosmopolitan home city in the Dubai Lifestyle section of our website www.emirates.com/careers
