Specialist Technology Regulations & Business Management (UAE National Role)

*Role is for UAE Nationals only

The role of Specialist - Technology Regulation & Business Management constitutes the following:

• Ensures proactive reach out and assists the business and regulators to identify opportunities and guidance from a security viewpoint. The role would lead the team to reach out and act as first contact towards the business to ensure security is perceived as an enabler.
• Assist the team to align with business stakeholders on possible ways to meet security challenges and promote security awareness & risk culture across the organization. Creating the culture of business security champions to develop awareness across the organization.
• Ensure early involvement of security in business projects to avoid unnecessary rework or delays
• Tracks active risks via IT Risk register and highlight the issues and the business impact on relevant stakeholders.
• Be a part of the business unit team and act in a consultative way to help business improve its security posture and adhere to security policies and expected controls
• Educate and assist the business with data security controls with respect to regulations where Emirates NBD operates
• Monitor, interpret and translate emerging technology, cyber, data, outsourcing, privacy and AI regulations (local and international) into actionable requirements, impact assessments and roadmaps for the business and Group IT
• Assist the team to ensure compliance with existing and upcoming regulations by leveraging GRC platforms, analytics and AI-enabled tooling
• Support the team with external and internal audit requirements related to technology, security and data protection
• Ensures adherence to AI governance framework in line with regulatory expectations and the Group's Responsible AI principles.

• Manage & implement local & international regulatory security standards where Emirates NBD operates in
• Maintain a Group-wide regulatory register mapped to policies, controls and control owners.
• Coordinate regulatory inspections, self-assessments and attestations, and track remediation to closure
• Align with business stakeholders on required solutions to security challenges faced
• Ensure early involvement of security teams and proactive reach out
• Run AI regulatory assessments covering security, privacy, data quality, bias & fairness, explainability, robustness, human oversight and third-party risk requirements
• Provide technology-risk input to the AI Governance Committee
• Tracking & closure of audit related observations
• Assist with stakeholder interactions and management reporting
• Support with usage of GRC platforms, AI technologies, automated dashboards for regulatory reporting
• Assist with KRIs/KPIs and dashboards for regulatory, AI risk posture and management reporting
• Track the IT Risk register to ensure risks are tracked to closure
• Highlight the business impact on senior stakeholders by extrapolating the risks from the register.
• Identify, track and implement security KPIs across the organization
• Conduct Security Awareness sessions across the group to improve risk culture and align with regulatory requirements for the geographies where Emirates NBD operates
• Build lasting relationships with technical and business stakeholders to create a coherent and collaborative environment that balances security and functionality in order to ensure threats that affect customer or employee data are managed effectively and, at the same time, the business is able to meet its agile and quick time-to-market strategy
• Partner with cross-functional core stakeholders within both security, technology, Data & AI, business, risk, compliance & audit to influence regulatory direction and facilitate key decision points for inclusions within business requirements
• Communicate impact of not including regulatory requirements to stakeholders both at the technical level (group IT) and at the end user level (business)
• Act as an advisor to Group IT & business stakeholders by ensuring effective decision-making using facts, regulatory knowledge & laws and providing options for possible solutions to challenges

• Master’s Degree in Business Management or equivalent
• Executive Education training (like Harvard, INSEAD, etc.)
• CISSP (optional), CISM, CRISC, ISMS lead implementer, IAPP AIGP, ISACA AAISM / AAIA
• PCI 4.0, ISO 27001, Cloud Security Alliance (CCSK)
• Privacy certification (e.g. CIPP/E, CIPM, CDPSE)
• NESA knowledge (preferably implementation)
• CBUAE regulations including technology, cyber, outsourcing, operational resilience, CPR, AI/ML etc.
• SAMA/MAS/GDPR/RBI Regulations
• Deep experience in implementing regulatory controls to ensure alignment of business and IT requirements including translation of business requirements into security requirements (vice versa).
• Deep experience in communication and alignment with security teams and implementation teams.
• Deep expertise on current regulatory agenda and corresponding assessment methodologies
• 3-5 years’ experience in the Information Security domain of which at least 3 years in the financial industry
• 3-5 years’ experience of understanding the financial industry, market, and specific operations that relate to banking & finance

UAE (primary)

• CBUAE regulations and standards relevant to technology, cyber, outsourcing, operational resilience, consumer protection and enabling technologies (incl. AI/ML guidance)
• UAE Information Assurance Regulation (formerly NESA); UAE Federal PDPL (Decree-Law 45/2021)
• UAE National AI Strategy 2031 and UAE Charter for the Development & Use of AI; DIFC Data Protection Law (incl. Regulation 10 on autonomous systems) and ADGM requirements
• GCC & international jurisdictions where the Group operates
• KSA: SAMA Cyber Security Framework, NCA ECC, SDAIA AI Ethics Principles and KSA PDPL
• Other: RBI (incl. AI / FREE-AI framework) and India DPDP Act; MAS TRM, FEAT principles and AI risk management guidance; CBE (Egypt); BDDK / KVKK (Türkiye); CBB (Bahrain); UK PRA / FCA
• EU AI Act, GDPR, DORA and NIS2 (for extraterritorial impact and industry benchmarking)

Standards & frameworks

• ISO/IEC 42001 (AI management system), ISO/IEC 23894 (AI risk), NIST AI RMF (incl. Generative AI profile), OECD AI Principles
• ISO/IEC 27001:2022, NIST CSF 2.0, PCI DSS v4.0, SWIFT CSCF, CSA Cloud Controls Matrix
• Deep knowledge of regulatory frameworks and how to embed them into business requirements (Technical)
• Mediocre technical background covering heterogeneous technologies and multiple security domains (Technical)
• Knowledge required of security controls, typical pitfalls and required measures for security compliance. Deep experience of the current technology backbone and available technologies within the security space (Technical)
• Deep knowledge of the interface to the implementation including development methodology knowledge including latest market trends and their possible application to the bank
• Deep knowledge of current business priorities and projects and corresponding business goals
• Collaborative leadership style that involves a mix of resource & project planning along with delegation, decision making & conflict resolution (Management)
• Superior verbal & written communication skills (Management)
• Good presentation skills (Management)
• Business, Technical & Audit Stakeholder Management skills (Management)
• Security Contract Management (Management)

Negotiation Skills (Management)

#LI-SA1