Lead - Security Governance and Assurance (Inception42)

Inception42, a G42 company, is the region\u2019s leading innovator of AI-powered domain-specific as well as industry-agnostic products, built on a rich heritage of research and development. Within the G42 ecosystem, Inception functions as the core intelligence layer \u2013 transforming data and compute infrastructure into real-world, applied AI solutions. Beyond its commercial endeavors, Inception is committed to creating positive societal impact. For more information, please visit www.inception42.ai Inception42, a G42 company, is the region\u2019s leading innovator of AI-powered domain-specific as well as industry-agnostic products, built on a rich heritage of research and development. Within the G42 ecosystem, Inception42 functions as the core intelligence layer \u2013 transforming data and compute infrastructure into real-world, applied AI solutions. Beyond its commercial endeavors, Inception42 is committed to creating positive societal impact. For more information, please visit www.inceptionai.ai Lead security governance and assurance with identity and access management as the primary technical focus. Own the access model, policies, controls, and evidence used by auditors, regulators, and customers. Act as the hands-on identity design authority, guide engineers and analysts, and manage identity tooling and vendors, working with Information Security, Platform Engineering, Application Support, Internal Audit, HR, and system owners. \u2022 Own the identity and access management strategy and roadmap, covering joiner-mover-leaver lifecycle, authentication, authorisation, privileged access and federation. \u2022 Design and maintain the organisation's role-based access control model, including role definitions, entitlement structures and segregation of duties, and keep it workable as the business changes. \u2022 Own access governance, including periodic access reviews and certification, entitlement recertification, and evidence that least privilege is applied in practice rather than in policy. \u2022 Set the standards and patterns for privileged access management across infrastructure, applications and endpoints, including endpoint privilege management and the removal of standing local administrator rights, so that elevation is controlled, time-bound and auditable. \u2022 Optimise existing privileged access tooling and make an evidence-based case for change where it limits required controls. \u2022 Define how applications integrate with identity, covering SSO, SAML, OAuth and OIDC, Conditional Access and modern authentication, and review integrations against those standards before they go live. \u2022 Automate identity lifecycle and access provisioning to reduce manual effort and the errors that come with it. \u2022 Own the security governance framework for the domain, including policies, standards and control definitions mapped to ISO 27001, NIST CSF and applicable UAE requirements. \u2022 Lead assurance activity across control testing, internal and external audit, and customer security due diligence, and drive findings through to closure. \u2022 Provide security review and design authority for new systems, cloud workloads and acquisitions, with particular attention to how identity and access are handled. \u2022 Define and report identity and access metrics, including privileged account inventory, standing administrator rights, orphaned and dormant accounts, review completion, provisioning performance and exceptions. \u2022 Mentor engineers and analysts, and raise the standard of identity practice across the wider technology function. \u2022 Within six months, assess privileged, dormant, standing, and endpoint administrator access; prioritise and close the most material risks; agree the target RBAC model; and establish evidenced access reviews and integration standards. \u2022 Within twelve months, implement RBAC and segregation of duties across priority systems; reduce standing privilege through time-bound, auditable access; automate identity lifecycle; close audit findings without recurrence; and use routine metrics and knowledge sharing to improve identity capability. \u2022 Deep, hands-on expertise across enterprise identity and access management, covering identity governance and administration, single sign-on, multi-factor authentication, and privileged access management across both infrastructure and endpoints. \u2022 Has designed and implemented an RBAC model at enterprise scale, including role engineering, entitlement design and segregation of duties, and made it work operationally. \u2022 Strong Microsoft Entra ID capability, including Conditional Access, Privileged Identity Management, hybrid identity and application registration. \u2022 Practical experience of at least one enterprise IGA platform, such as SailPoint, Saviynt or an equivalent, including access certification campaigns and lifecycle automation. \u2022 Security governance and assurance capability. Has written polici

Deep, hands-on expertise across enterprise identity and access management, covering identity governance and administration, single sign-on, multi-factor authentication, and privileged access management across both infrastructure and endpoints. Has designed and implemented an RBAC model at enterprise scale, including role engineering, entitlement design and segregation of duties, and made it work operationally. Strong Microsoft Entra ID capability, including Conditional Access, Privileged Identity Management, hybrid identity and application registration. Practical experience of at least one enterprise IGA platform, such as SailPoint, Saviynt or an equivalent, including access certification campaigns and lifecycle automation. Security governance and assurance capability. Has written polici

Lead security governance and assurance with identity and access management as the primary technical focus. Own the access model, policies, controls, and evidence used by auditors, regulators, and customers. Act as the hands-on identity design authority, guide engineers and analysts, and manage identity tooling and vendors. Own the identity and access management strategy and roadmap, covering joiner-mover-leaver lifecycle, authentication, authorisation, privileged access and federation. Design and maintain the organisation's role-based access control model, including role definitions, entitlement structures and segregation of duties. Own access governance, including periodic access reviews and certification, entitlement recertification, and evidence that least privilege is applied in practice. Set the standards and patterns for privileged access management across infrastructure, applications and endpoints. Optimise existing privileged access tooling and make an evidence-based case for change where it limits required controls. Define how applications integrate with identity, covering SSO, SAML, OAuth and OIDC, Conditional Access and modern authentication, and review integrations before they go live. Automate identity lifecycle and access provisioning to reduce manual effort. Own the security governance framework for the domain, including policies, standards and control definitions mapped to ISO 27001, NIST CSF and applicable UAE requirements. Lead assurance activity across control testing, internal and external audit, and customer security due diligence. Drive findings through to closure. Provide security review and design authority for new systems, cloud workloads and acquisitions, with particular attention to how identity and access are handled. Define and report identity and access metrics. Mentor engineers and analysts, and raise the standard of identity practice across the wider technology function. Within six months, assess privileged, dormant, standing, and endpoint administrator access; prioritise and close the most material risks; agree the target RBAC model; and establish evidenced access reviews and integration standards. Within twelve months, implement RBAC and segregation of duties across priority systems; reduce standing privilege through time-bound, auditable access; automate identity lifecycle; close audit findings without recurrence; and use routine metrics and knowledge sharing to improve identity capability.