Technical Assurance Manager

Role : Technical Assurance Manager Location : Abu Dhabi Role Purpose: Lead ADIB’s second-line technical security assurance across infrastructure, applications, databases, cloud, networks, security platforms and critical business services. The role owns the risk-based Technical Assurance Plan, methodologies and tools; provides evidence-based conclusions on control design, implementation, compliance and operating effectiveness; leads technical regulatory assurance, Red Team assurance and cyber resilience assurance; and independent challenges, reports, retests and validates remediation. First-line functions remain accountable for the control ownership, operation and remediation. While this role operates from a second line assurance level Key Accountabilities of the role Develop and execute a risk-based annual assurance plan covering critical services, technologies, controls and relevant third parties. Maintain the assurance universe and prioritize reviews using criticality, threats, regulatory obligations, change, incidents and prior findings. Independently test control design, implementation, compliance and operating effectiveness using evidence-based methods. Own assurance methodologies, test scripts, sampling and evidence standards, aligned with NIST, ISO 27001, PCI DSS, SWIFT CSCF, UAE and CBUAE requirements. Operate assurance tools and expand automated or continuous monitoring to identify control drift, gaps and non-compliance. Assess findings by likelihood, exploitability, impact, criticality and compensating controls; align ratings with the Enterprise Risk Framework. Lead second-line technical assurance for regulatory and industry obligations, maintaining traceability from requirements to controls and evidence. Define and govern threat-informed Red Team exercises; coordinate specialist execution and validate preventive, detective, response and recovery controls. Use penetration-testing and vulnerability results as assurance evidence, avoiding duplication of first-line specialist testing. Assure cyber resilience, recovery integrity, security-control survivability, crisis simulation, dependency mapping and applicable RTO/RPO evidence required for Cyber security and privacy Assess AI/ML and AI-enabled technologies, including access, data protection, integration security, monitoring, prompt/output integrity and adversarial testing. Own the finding lifecycle from evidence validation and risk rating through escalation, independent retesting and closure. Provide assurance validation to projects and technology change without assuming first-line control ownership inline with assurance plan Support inspections and audits with complete, accurate and audit-ready evidence, working papers and responses. Coordinate with Cyber Defense, Technology, Risk, Compliance, Internal Audit and control owners while preserving second-line independence. Manage and develop the Technical Assurance team and keep assurance scope, methods and tooling current with emerging threats and regulatory change. Specialist Skills / Technical Knowledge Required for this role: Must have Deep expertise in second-line technical assurance and evidence-based assessment across infrastructure, applications, databases, cloud, networks and security platforms. Strong knowledge of control design and operating-effectiveness assessment. Working knowledge of major information security, cybersecurity and regulatory control frameworks. Strong technical risk assessment, evidence evaluation, documentation, stakeholder management and executive reporting skills. Bachelor’s or master’s degree in information security, cybersecurity, engineering, computer science, IT or a related discipline. Desired Knowledge of NIST SP 800-53A and NIST SP 800-115 assessment principles. Familiarity with ISO/IEC 27001, NIST CSF, PCI DSS, SWIFT CSCF, UAE Information Assurance and CBUAE requirements. Practical experience with automated compliance, continuous assurance, technical telemetry, configuration evidence and security-platform data. Understanding of penetration testing, vulnerability assessment, Red/Purple Team methods, MITRE ATT&CK, OWASP, PTES and CIS Benchmarks. Knowledge of IAM/PAM, SIEM/SOC, DLP, cryptography, certificate management, CSPM/CASB, WAF, DDoS and endpoint security. Understanding of cyber resilience, recovery controls, dependency validation, recovery integrity and resilience-testing evidence. Relevant certifications such as CISA, CISSP, CRISC, CISM, OSCP, GPEN, GIAC or PCI ISA/QSA; combined assurance and technical credentials are preferred.

Bachelor’s or master’s degree in information security, cybersecurity, engineering, computer science, IT or a related discipline. Relevant certifications such as CISA, CISSP, CRISC, CISM, OSCP, GPEN, GIAC or PCI ISA/QSA; combined assurance and technical credentials are preferred. Familiarity with ISO/IEC 27001, NIST CSF, PCI DSS, SWIFT CSCF, UAE Information Assurance and CBUAE requirements. Desired Knowledge of NIST SP 800-53A and NIST SP 800-115 assessment principles. Practical experience with automated compliance, continuous assurance, technical telemetry, configuration evidence and security-platform data. Understanding of penetration testing, vulnerability assessment, Red/Purple Team methods, MITRE ATT&CK, OWASP, PTES and CIS Benchmarks. Knowledge of IAM/PAM, SIEM/SOC, DLP, cryptography, certificate management, CSPM/CASB, WAF, DDoS and endpoint security. Understanding of cyber resilience, recovery controls, dependency validation, recovery integrity and resilience-testing evidence.

Lead second-line technical assurance for regulatory and industry obligations, maintain assurance methodologies and tools, own assurance plan and evidence standards, independently test control design and operating effectiveness, coordinate Red Team exercises, validate preventive, detective and recovery controls, ensure traceability from requirements to controls and evidence, provide assurance validation to projects and technology change, support inspections and audits with audit-ready evidence, manage and develop the Technical Assurance team, preserve second-line independence, coordinate with Cyber Defense, Technology, Risk, Compliance, Internal Audit and control owners.