Cybersecurity Assurance & Assessment Specialist

About the role

The Information Security Officer will lead end‑to‑end security assurance activities across the organization’s technology landscape, covering applications, cloud, infrastructure, identity, and third‑party environments. The role ensures that security controls are designed, implemented, validated, and continuously enforced in line with industry standards and regulatory frameworks.

Key responsibilities

• Lead security assessments, architecture reviews, vulnerability management and assurance activities.
• Define and operate a Security Assurance Framework for control validation, coverage tracking and continuous assurance.
• Perform in‑depth assessments of web applications, APIs, mobile apps, cloud platforms, containers and infrastructure, identifying advanced risks such as business‑logic flaws and privilege abuse.
• Define, maintain and automate secure configuration baselines (OS, databases, network devices, cloud services, identity platforms) aligned with CIS Benchmarks and organizational risk.
• Conduct threat modeling, security architecture reviews and ensure alignment with Zero Trust principles.
• Assess third‑party vendors, SaaS providers and external integrations for data protection, encryption and privacy compliance.
• Support governance, compliance and audit activities for ISO 27001, NIST CSF, Qatar NIA/QCSF and related frameworks.

Required profile

• Proven experience in security assurance, risk management and vulnerability management across diverse technology stacks.
• Strong understanding of secure SDLC, DevSecOps practices and cloud‑native security controls.
• Ability to translate technical findings into business‑level risk statements and remediation plans.
• Excellent communication skills to work with engineering, operations and senior leadership.

Required skills

• Security assessments and architecture reviews
• Vulnerability management
• Cloud security (AWS, Azure, GCP)
• Container security
• Secure configuration baselines and CIS Benchmarks
• Threat modeling
• Zero Trust design principles
• ISO 27001, NIST CSF, Qatar NIA/QCSF frameworks