Senior Specialist, Information Security (GRC)

About us: Tabby is on a mission to give people power over their money. For too long, financial systems have worked for the institutions that built them, not the people using them. Runaway interest, fine print and limited access have left many behind, feeling shut out of a system that wasn't setting them up for success. We're building a different kind of system—in a complete money app to send, spend and save. One that's clear, flexible and puts people and businesses in control. Founded in 2019, we serve customers and businesses across Saudi Arabia, the United Arab Emirates and Kuwait. Millions of customers and 65,000 global brands, government services and small businesses rely on us today. What began as a better way to pay at checkout has grown into a financial system working the way it should have all along. About the role: The Senior Information Security Specialist (GRC) independently leads complex governance, risk, and compliance activities and serves as a subject matter expert in one or more GRC domains — enterprise information security governance, risk management frameworks, regulatory compliance, or third-party risk management. The role produces high-quality GRC deliverables, provides technical mentoring to junior and mid-level team members, and contributes directly to the continuous improvement of the organization's GRC framework, risk treatment processes, and compliance reporting mechanisms. The Senior Specialist bridges technical execution and programme leadership, collaborating with leads, legal, audit, and business stakeholders to deliver mature, effective GRC outcomes aligned with the UAE Fintech regulatory environment. Information Security Governance Leadership: - Lead the development, review, and continuous improvement of information security policies, standards, procedures, and governance frameworks, ensuring alignment with CSF, NCA ECC, ISO 27001, and PCI-DSS. - Serve as the subject matter expert for assigned regulatory domains, providing authoritative interpretation of requirements and translating them into implementable control objectives. - Monitor and proactively track regulatory and legal developments affecting information security, assessing impact and recommending updates to the governance framework. - Prepare and review governance documentation (RACI matrices, security charter updates, governance committee packs) and present findings to senior stakeholders. - Lead the preparation of regulatory self-assessments and compliance attestations, coordinating evidence gathering and quality-reviewing submissions before senior sign-off. - Mentor junior team members on governance documentation quality, regulatory interpretation, and risk assessment methodology. Enterprise Risk Management: - Lead the execution of complex enterprise information security risk assessments, applying advanced qualitative and quantitative methodologies to produce risk profiles aligned with the organisation's risk appetite. - Own and maintain the enterprise information security risk register, ensuring accuracy, currency, and appropriate escalation of significant risks. - Lead BIA processes for critical business functions, coordinating with asset owners, analysing recovery requirements, and producing BIA outputs for Business Continuity and Disaster Recovery planning. - Design and execute control effectiveness testing programmes, producing findings reports with gap analysis and risk-ranked remediation recommendations. - Lead third-party information security risk management, designing assessment frameworks, conducting in-depth vendor reviews, and maintaining the third-party risk register. - Produce executive-quality risk reporting with trend analysis, emerging risk identification, and treatment progress tracking for senior management and committee consumption. Compliance Programme Delivery: - Lead compliance monitoring activities for CSF, NCA ECC, PDPL, ISO 27001, and PCI-DSS, producing gap analyses, treatment plans, and periodic compliance status reports. - Manage internal and external audit cycles, coordinating evidence collection, reviewing evidence quality, engaging with auditors, and tracking remediation to closure. - Design and deliver the security awareness programme, producing targeted content for different staff segments, conducting awareness sessions, and analysing effectiveness metrics. - Develop and maintain GRC programme metrics dashboards, ensuring KPIs and KRIs are accurately measured and presented to senior management on schedule. - Lead the integration of information security requirements into third-party contracts, procurement processes, and major project onboarding. - Contribute to the development of the information security programme strategy, identifying capability improvement opportunities and recommending investment priorities to the Lead. Cross-Functional Collaboration & Knowledge Leadership: - Serve as the primary GRC point of contact for assigned business and technology teams, providing

Note: The posting does not include a clearly delineated 'Requirements', 'Qualifications', or 'Minimum qualifications' section. The role description outlines responsibilities and capabilities expected, but no explicit bulleted minimum criteria are provided as a separate requirements block.

Lead governance, risk, and compliance activities within GRC domains (enterprise information security governance, risk management frameworks, regulatory compliance, third-party risk management). Develop and improve information security policies, standards, procedures, and governance frameworks aligned with CSF, NCA ECC, ISO 27001, and PCI-DSS. Interpret regulatory requirements and translate into actionable control objectives. Track regulatory developments and update governance framework accordingly. Prepare governance documentation and present to senior stakeholders. Coordinate regulatory self-assessments and compliance attestations. Mentor junior staff on governance documentation and risk assessment methodology. Lead enterprise information security risk assessments and maintain risk register. Lead BIA processes and coordinate with asset owners for Business Continuity/Disaster Recovery. Design and execute control testing programmes with gap analyses and remediation plans. Lead third-party information security risk management and maintain the third-party risk register. Produce executive risk reporting with trend analysis. Monitor CSF, NCA ECC, PDPL, ISO 27001, and PCI-DSS compliance, produce gap analyses and treatment plans. Manage internal and external audit cycles and remediation tracking. Design and deliver security awareness programmes. Develop and maintain GRC metrics dashboards. Integrate information security requirements into third-party contracts and procurement processes. Contribute to the information security programme strategy and investment prioritisation. Act as the primary GRC point of contact for assigned business and technology teams.