Information Security Consultant

Role Overview

Information Security Consultant at United Al Saqer Group, based in the United Arab Emirates.

Company Overview

Established more than 40 years ago, United Al Saqer Group (UASG) is one of the leading multi-sector business groups in the United Arab Emirates. The UASG owns and operates a diverse portfolio of six UAE-based companies spanning several key industry sectors: Abu Dhabi Motors, Dalma Motors, Al Saqer Heavy Equipment, Al Saqer Property Management, Royal International Construction, and Royal Joinery.

Role Purpose

The Information Security Consultant provides expert guidance on information security strategies, assesses risks, develops policies, and implements solutions to safeguard the organization's data, systems, and infrastructure. This role ensures compliance with cybersecurity standards and supports mitigation of security threats and vulnerabilities.

Key Responsibilities

Security Operations & Threat Management

• Manage and operate security tools including SIEM, EDR, PAM, DLP, and IDS/IPS to detect, analyze, and respond to threats.
• Lead response to security incidents and breaches, performing root cause analysis and implementing corrective and preventive actions.
• Proactively hunt for threats across the IT landscape, ensuring the security of core network assets, email gateways, and cloud services.
• Conduct regular vulnerability scans and coordinate penetration testing, validate findings, and drive remediation efforts with relevant teams.
• Monitor and optimize security logs and alerts to ensure effective detection and timely escalation of suspicious activities.

Security Architecture & Engineering

• Provide expert advice on secure system designs, network defenses, access controls, and encryption standards.
• Secure cloud configurations in multi-cloud environments, with hands-on expertise in Azure and Microsoft 365, including implementation of logging, encryption, and secure DevOps practices.
• Implement and manage Identity & Access Management (IAM) and Privilege Access Management (PAM) solutions, enforcing least privilege access through regular privilege audits and access reviews.
• Conduct security architecture reviews for new projects, applications, and integrations, ensuring alignment with best practices and compliance standards.
• Support Zero Trust adoption and embed security into the software development lifecycle (SDLC) by enforcing secure access principles, promoting secure coding practices, and integrating DevSecOps.
• Evaluate, recommend, and deploy security tools and technologies to strengthen the organization's defensive posture.

Governance, Risk & Compliance

• Develop, maintain, and implement corporate information security policies, standards, and procedures aligned with organizational processes and industry best practices.
• Assist in maintenance and continual improvement of the Information Security Management System (ISMS), ensuring compliance and documentation aligned with ISO 27001, ISO 20000-1, UAE IA, PDPL, and GDPR.
• Conduct risk assessments on internal systems, business processes, and third-party vendors to evaluate security controls and ensure compliance with corporate policies and regulatory requirements.
• Support internal and external audits by preparing documentation, evidence of controls, and responses to audit findings.
• Promote a strong security culture by supporting awareness and training programs, ensuring staff understand their compliance responsibilities.
• Define and track security KPIs and metrics to measure program effectiveness and report on risk posture to management.

Reporting & Continuous Improvement

• Prepare clear and detailed reports on security incidents, risk assessment findings, audit outcomes, and remediation progress for management and stakeholders.
• Track and analyze security metrics, trends, and KPIs to measure control effectiveness and highlight areas for improvement.
• Capture lessons learned from incidents, tests, and assessments, and integrate them into security processes, playbooks, and awareness programs.
• Research emerging threats, new attack techniques, and innovative security tools to continuously strengthen detection and response capabilities.
• Participate in Business Continuity (BCP) and Disaster Recovery (DR) testing, as well as cyber crisis tabletop exercises, to validate preparedness and strengthen organizational resilience.