*Role is for UAE Nationals only
Contribute to Group IT Risk and Cybersecurity at Emirates NBD Group as Specialist Technology Regulations & Business Management, supporting sound risk decisions, controlled exposures and timely remediation through risk assessments, portfolio reviews and control actions, sound controls and continuous improvement.
Key Tasks:-
- Ensures proactive reach out and assists the business and regulators to identify opportunities and guidance from a security viewpoint. The role would lead the team to reach out and act as first contact towards the business to ensure security is perceived as an enabler.
- Leads the team to align with business stakeholders on possible ways to meet security challenges and promote security awareness & risk culture across the organisation, creating a culture of business security champions. Ensures early involvement of security in business projects to avoid unnecessary rework or delays.
- Tracks active risks via the IT Risk register and highlights the issues and the business impact on relevant stakeholders.
- Is a part of the business unit team and acts in a consultative way to help the business improve its security posture and adhere to security policies and expected controls.
- Educates and assists the business on data security controls with respect to regulations where Emirates NBD operates.
- AI Governance: Designs, operationalizes and continuously improves the technology-risk elements of the Group AI governance framework, ensuring AI / GenAI / agentic AI use cases are inventoried, risk-tiered, assessed and controlled across their lifecycle in line with regulatory expectations and the Group's Responsible AI principles.
- Regulatory Landscape & Horizon Scanning: Monitors, interprets and translates emerging technology, cyber, data, outsourcing, privacy and AI regulations (local and international) into actionable requirements, impact assessments and roadmaps for the business and Group IT.
- Regulatory Team Transformation: Acts as a change agent in transforming the regulatory function from a manual, reactive, compliance-checking model to a data-driven, automated and advisory model, leveraging GRC platforms, analytics and AI-enabled tooling.
- Support the team with external and internal audit requirements related to technology, security and data protection.
- Assess, track and maintain regulatory compliance across the Group (local & international)
- Manage & implement local & international regulatory security standards where Emirates NBD operates
- Maintain a Group-wide regulatory register mapped to policies, controls and control owners
- Coordinate regulatory inspections, self-assessments and attestations, and track remediation to closure
- Aligning the Group Information Security Strategy to Emirates NBD business strategy
- Establish and operationalize AI Governance (technology & cyber risk)
- Develop and maintain AI governance policies, standards, procedures and control frameworks aligned to ISO/IEC 42001, NIST AI RMF and applicable regulations
- Run AI regulatory assessments covering security, privacy, data quality, bias & fairness, explainability, robustness, human oversight and third-party risk requirements
- Partner with Model Risk Management, Data Governance, Data Protection, Compliance and Legal to ensure end-to-end AI lifecycle governance and monitoring
- Provide technology-risk input to the AI Governance Committee
- Regulatory horizon scanning and change management
- Continuously monitor the evolving technology, cyber, data-privacy and AI regulatory landscape across the Group's jurisdictions
- Perform regulatory gap and impact assessments; translate requirements into business and technical requirements, control changes and remediation roadmaps
- Brief senior management and committees on upcoming regulatory changes and their business impact
- Represent the Group in regulatory consultations, industry working groups and sandboxes where appropriate
- Transform the regulatory function (Automation & analytics)
- Define and deliver the regulatory team's transformation roadmap covering operating model, processes, tooling, data and skills
- Implement and optimize GRC platforms (e.g. regulatory obligation mapping, control libraries, automated evidence collection)
- Apply data analytics and approved AI technologies (e.g. GenAI for regulation summarization and mapping) to improve efficiency, with appropriate human review
- Develop KRIs/KPIs and dashboards for regulatory and AI risk posture reporting
- Coach and upskill team members on AI, regulatory and digital skills
- Govern and track the IT Risk register
- Track the IT Risk register to ensure risks are tracked to closure, including AI and emerging technology risks.
- Highlight the business impact to senior stakeholders by extrapolating the risks from the register
- Improve Security and Responsible AI Awareness across the Group
- Identify, track and implement security KPIs across the organisation
- Conduct security awareness sessions across the Group to improve risk culture and align with regulatory requirements for the geographies where Emirates NBD operates
- Design and deliver awareness on safe and responsible use of AI, with acceptable-use and data-handling expectations
- Build lasting relationships with technical and business stakeholders to create a coherent and collaborative environment that balances security and functionality, ensuring threats that affect customer or employee data are managed effectively while the business meets its agile and quick time-to-market strategy.
- Partner with cross-functional core stakeholders within security, technology, Data & AI, business, risk, compliance & audit to influence regulatory direction and facilitate key decision points for inclusion within business requirements.
- Communicate the impact of not including regulatory requirements to stakeholders both at the technical level (technology) and at the end-user level (business).
- Act as an advisor to technology & business stakeholders by ensuring effective decision making using facts, regulatory knowledge and providing options for possible solutions to challenges.
- Bachelor’s degree in information technology, Computer Science, Engineering, Law or Business (Master's degree in Business Management, Technology Management or equivalent preferred)
- Executive education (e.g. Harvard, INSEAD) in AI strategy, digital transformation or risk management
- At least one of: CISM, CISSP, CRISC, CGEIT
- AI governance certification: IAPP AIGP, ISACA AAISM / AAIA, or ISO/IEC 42001 Lead Implementer / Lead Auditor
- ISO/IEC 27001 Lead Implementer / Lead Auditor
- Privacy certification (e.g. CIPP/E, CIPM, CDPSE)
- Cloud security certification (e.g. CCSK, CCSP); PCI QSA / PCI DSS v4.0 knowledge
- 5-8 years' experience in information security, technology risk or technology regulatory compliance, of which at least 3 years in the financial services industry
- Minimum 2 years' hands-on experience in AI governance, AI risk management, data governance (e.g. building AI policies, AI regulatory assessments)
- Deep experience in implementing regulatory controls to ensure alignment of business and IT requirements, including translation of business requirements into security requirements (and vice versa)
- Deep experience in communication and alignment with security teams and implementation teams
- Deep expertise in the current regulatory agenda and corresponding assessment methodologies across GCC and international jurisdictions
- Experience interacting with regulators (inspections, consultations, submissions) in the UAE / GCC
- Experience contributing to or leading a transformation programme (operating model, process re-engineering, GRC implementation or automation)
3 to 5 years' experience of understanding the financial industry, market and specific operations that relate to banking & finance
UAE (primary)
- CBUAE regulations and standards relevant to technology, cyber, outsourcing, operational resilience, consumer protection and enabling technologies (incl. AI/ML guidance)
- UAE Information Assurance Regulation (formerly NESA); UAE Federal PDPL (Decree-Law 45/2021)
- UAE National AI Strategy 2031 and UAE Charter for the Development & Use of AI; DIFC Data Protection Law (incl. Regulation 10 on autonomous systems) and ADGM requirements
GCC & international jurisdictions where the Group operates
- KSA: SAMA Cyber Security Framework, NCA ECC, SDAIA AI Ethics Principles and KSA PDPL
- Other: RBI (incl. AI / FREE-AI framework) and India DPDP Act; MAS TRM, FEAT principles and AI risk management guidance; CBE (Egypt); BDDK / KVKK (Türkiye); CBB (Bahrain); UK PRA / FCA
- EU AI Act, GDPR, DORA and NIS2 (for extraterritorial impact and industry benchmarking)
Standards & frameworks
- ISO/IEC 42001 (AI management system), ISO/IEC 23894 (AI risk), NIST AI RMF (incl. Generative AI profile), OECD AI Principles
- ISO/IEC 27001:2022, NIST CSF 2.0, PCI DSS v4.0, SWIFT CSCF, CSA Cloud Controls Matrix
Technical
- Deep knowledge of regulatory frameworks and how to embed them into business requirements
- Solid technical background covering heterogeneous technologies and multiple security domains (cloud, application, data, identity, network)
- Knowledge of security controls, typical pitfalls and required measures for security compliance; deep experience of the current technology backbone and available technologies within the security space
- Deep knowledge of the interface to implementation, including development methodologies (Agile, DevSecOps / MLOps) and latest market trends and their possible application to the bank
- Hands-on experience with GRC platforms and continuous control monitoring
AI & Data
- Understanding of AI / ML, Generative AI and agentic AI concepts, sufficient to challenge design and controls
- Knowledge of AI-specific risks and controls: bias & fairness, explainability, robustness, hallucination, prompt injection, data leakage, model/data poisoning, human oversight and AI supply-chain / third-party risk
- Data governance, data privacy (privacy-by-design, DPIAs) and data lineage principles
- Data analytics and visualization skills (e.g. Power BI, Excel, SQL) and practical, responsible use of GenAI tools for regulatory analysis
Managerial
- Change management and transformation skills: ability to define target operating models, redesign processes and drive adoption
- Deep knowledge of current business priorities and projects and corresponding business goals
- Collaborative leadership style that involves a mix of resource & project planning along with delegation, decision making & conflict resolution
- Superior verbal & written communication skills, including the ability to explain complex AI and regulatory topics to Board / senior management
- Good presentation skills
- Business, Technical & Audit Stakeholder Management skills
- Security and AI vendor contract management (incl. AI-specific contractual clauses)
- Negotiation skills
#LI-SA1
