Infosec and Threat Assessment Manager

COMPANY INTRODUCTION

Emirates NBD is a market leader across the MENAT (Middle East, North Africa and Türkiye) region with a presence in 13 countries, serving over 20 million customers. The Emirates NBD Group has a total of 853 branches and 4,213 ATMs / SDMs. Emirates NBD is the leading financial services brand in the UAE with a Brand value of USD 3.89 billion.

At the bank, we serve our customers and help them realise their financial objectives through a range of banking products and services including retail banking, corporate & institutional banking, Islamic banking, investment banking, private banking, asset management, global markets and treasury, and brokerage operations.

We are a key participant in the global digital banking industry, with 97% of all financial transactions and requests conducted outside of our branches. We also operate Liv, the lifestyle digital bank by Emirates NBD. With close to half a million users, it continues to be the fastest-growing digital bank in the region.

JOB PURPOSE :

The Infosec and Threat Assessment Manager will conduct testing for Emirates NBD infosec assets through focused threat based methodologies, to identify, expose and exploit vulnerabilities to improve Cyber readiness and review security controls and system configurations across IT systems across the group to ensure their security posture and compliance.

Key Responsibilities :

• Develop, manage and maintain the Security Assessment program as part of the Threat and Compliance (TCM) Charter and associated operating procedures based on the requirements of Emirates NBD policy, audit, compliance and regulatory requirements.
• Develop, manage and maintain Emirates NBD portfolio of security assessment services and associated service catalog.
• Develop, maintain and manage Emirates NBD threat modelling framework and operationalize these models into the security assessment program
• Collect open source intelligence on threats and vulnerabilities applicable to Emirates NBD technology stack
• Participate in event planning stages to develop Cyber assessment plans and conduct assessment tests against Emirates NBD group installations & controls
• Ensure threat controls and systems are reviewed for appropriate, effective and optimal configuration across the Group.
• Identify and track IT risks and gaps that are remediated through operational activities or treated via risk management process.
• Responsible for threat activity reporting and insight on the IT technology assets used by the group.
• Managing planned and ad-hoc review and reporting requests from stakeholders across Emirates NBD Technology and business functions
• Interact with Emirates NBD Technology leadership to ensure that assessment activities are planned, published and scheduled.
• Organize and participate in governance forums to present threats, associated vulnerabilities and compliance posture of the information assets of the bank.
• Act as a security ninja and advisor to internal teams to advise known methods of breaking and bypassing controls
• Participate in “Purple Teaming” exercises with defense teams
• Operationalizing the threat modelling framework to be utilized for the Security Assessment program
• Manage the portfolio of security assessment services
• Proficient in industry best practices in threat and vulnerability management, analytical and correlation tools
• Be accountable and responsible when conducting security assessments in a controlled manner that do not cause business impacts
• Ensure maximum accuracy of all data being generated from the assessment reports and the scope covered as part of the assessment are adequate and relevant.
• Identify and collate appropriate threat, vulnerability and risk metrics to ensure that representation of threats and risk are appropriate to risk appetite of the bank.
• Conduct report read-outs on observations with technical stakeholders (auditee) and work hand-in-hand with them on remediation plans.
• Work with Emirates NBD Technology leadership to ensure that identified vulnerabilities and agreed remediation plans are accepted and work with them to ensure that these are mitigated.
• Ensure threats and mitigation measures are correctly populated into the threat register with accurate estimated dates of compliance and threat ratings as per the group’s methodology

Key Requirements :