SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Tabby is a fintech company on a mission to give people power over their money through a complete money app for sending, spending, and saving. Founded in 2019, Tabby serves millions of customers and 65,000 global brands, government services, and small businesses across Saudi Arabia, the UAE, and Kuwait.
The Senior Information Security Specialist (GRC) independently leads complex governance, risk, and compliance activities and serves as a subject matter expert in one or more GRC domains—enterprise information security governance, risk management frameworks, regulatory compliance, or third-party risk management. This role produces high-quality GRC deliverables, provides technical mentoring to junior and mid-level team members, and contributes directly to continuous improvement of the organization's GRC framework, risk treatment processes, and compliance reporting mechanisms. The Senior Specialist bridges technical execution and programme leadership, collaborating with leads, legal, audit, and business stakeholders to deliver mature, effective GRC outcomes aligned with the UAE Fintech regulatory environment.
Key responsibilities include:
**Information Security Governance Leadership:** Lead development, review, and continuous improvement of information security policies, standards, procedures, and governance frameworks aligned with CSF, NCA ECC, ISO 27001, and PCI-DSS. Serve as subject matter expert for assigned regulatory domains, providing authoritative interpretation of requirements and translating them into implementable control objectives. Monitor and proactively track regulatory and legal developments affecting information security. Prepare and review governance documentation and present findings to senior stakeholders. Lead preparation of regulatory self-assessments and compliance attestations. Mentor junior team members on governance documentation quality, regulatory interpretation, and risk assessment methodology.
**Enterprise Risk Management:** Lead execution of complex enterprise information security risk assessments using advanced qualitative and quantitative methodologies. Own and maintain the enterprise information security risk register. Lead Business Impact Analysis (BIA) processes for critical business functions. Design and execute control effectiveness testing programmes. Lead third-party information security risk management, designing assessment frameworks and conducting in-depth vendor reviews. Produce executive-quality risk reporting with trend analysis and emerging risk identification.
**Compliance Programme Delivery:** Lead compliance monitoring activities for CSF, NCA ECC, PDPL, ISO 27001, and PCI-DSS. Manage internal and external audit cycles. Design and deliver the security awareness programme. Develop and maintain GRC programme metrics dashboards. Lead integration of information security requirements into third-party contracts and procurement processes. Contribute to development of information security programme strategy.
**Cross-Functional Collaboration & Knowledge Leadership:** Serve as primary GRC point of contact for assigned business and technology teams. Lead information classification and security requirements reviews for significant IT, product, and business projects. Contribute to GRC knowledge base development. Represent GRC function in cross-functional working groups and regulatory workstreams.
**Requirements:**
- Bachelor's degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Risk Management, or related field (Master's degree in Information Security, Risk Management, or Business Administration is an advantage)
- 3+ years of progressive professional experience in information security governance, risk management, or compliance
- Demonstrable experience independently leading risk assessment cycles, regulatory compliance programmes, or audit coordination activities
- In-depth knowledge of at least two regulatory frameworks applicable to Fintech environments (CSF, NCA ECC, PDPL, ISO 27001, PCI-DSS) is required
- Experience in a regulated Fintech or banking environment is strongly preferred
- ISO 27001 Lead Implementer certification (required)
- CRISC (Certified in Risk and Information Systems Control) or CISM certification (required or actively working toward)
- CDPSE (Certified Data Privacy Solutions Engineer) is an advantage for PDPL specialists
