ABOUT THE ROLE
DTS Solution advises government, banking, energy, aviation, healthcare and critical infrastructure clients across the UAE and the wider GCC.
Our Cyber Advisory and GRC practice is where regulation, risk and architecture meet: we tell a client where they stand against the standards that apply to them, and then we design and help build the function that keeps them there.
We are hiring a Senior Cybersecurity Consultant to lead that work across governance, risk and compliance, third-party risk, privacy, data security and the newer and fast-moving area of AI governance.
The role is a mix of assessment and build. You might spend one month auditing an environment against the UAE Information Assurance Standards, ISO/IEC 27001 or the UAE Personal Data Protection Law, and the next designing the target operating model and multi-year roadmap that closes what the audit found.
This is a hands-on consulting role, not a policy-library role. You will sit in front of CISOs, risk committees and regulators, and you will own your engagements end to end — scope, delivery, report, and the conversation that follows.
What sets the work apart is that DTS also runs offensive and defensive practices, so the controls you recommend get tested by people down the corridor.
"If you enjoy writing a control framework but not defending it to an audit committee, this is not the role. If you enjoy both, read on."
WHAT YOU WILL DO
The scope below describes the full span of the practice. No single engagement touches all of it, and we do not expect one person to be equally deep in every area. We do expect strength in governance and assurance, real delivery experience in privacy, and the appetite to lead on AI governance as that work scales.
STRATEGY, ROADMAP AND TARGET OPERATING MODEL
1. Build cybersecurity strategies and multi-year transformation roadmaps anchored in business objectives, regulatory drivers and the budget the client actually has.
2. Design target operating models for security and GRC functions — capability models, organisation structures, RACI, service catalogues, process flows and resourcing plans.
3. Produce security architecture and control blueprints, reference architectures and capability baselines using NIST CSF, C2M2 and comparable maturity models.
4. Define KPI and KRI sets, governance committee structures and the reporting pack that goes to the board.
5. Run maturity and benchmarking assessments, and translate the scores into a prioritised investment case.
GOVERNANCE, RISK AND REGULATORY ASSURANCE
1. Lead gap assessments, internal audits and certification readiness against the UAE Information Assurance Standards, ISO/IEC 27001 and ISO/IEC 27701, the UAE Federal Personal Data Protection Law, and sector and regional frameworks — Dubai ISR, ADHICS, NCA ECC and CCC, SAMA CSF, CBUAE regulations, DIFC Data Protection Law, ADGM Data Protection Regulations, Qatar NIA, PCI DSS and the SWIFT Customer Security Programme.
2. Author and rationalise policies, standards, procedures and control frameworks, including unified control sets mapped across several frameworks so a client tests once and reports many times.
3. Stand up and operate risk management — risk registers, risk appetite statements, quantitative and qualitative methodologies, treatment plans, and exception and waiver handling.
4. Manage compliance remediation programmes and track control effectiveness through to closure rather than to a report.
5. Prepare clients for, and support them through, regulator and certification body audits.
THIRD-PARTY AND SUPPLY CHAIN RISK MANAGEMENT
1. Design and implement third-party risk management programmes — vendor tiering and criticality models, due diligence questionnaires, assessment workflows, contractual security and privacy clauses, and offboarding.
2. Perform third and fourth-party assessments, including cloud and SaaS providers, and run continuous monitoring and remediation tracking.
3. Address concentration risk, dependency mapping and nth-party exposure, which is where most regional programmes are currently weakest.
GRC ENGINEERING AND AUTOMATION
A growing share of our GRC work is engineering. Clients no longer accept an annual spreadsheet exercise, and we do not sell one.
1. Implement and integrate GRC and IRM platforms such as ServiceNow IRM, Archer, OneTrust and MetricStream — data models, workflows, assessment templates and reporting.
2. Automate evidence collection and continuous control monitoring by pulling from cloud security posture tools, identity providers, EDR, SIEM, ticketing and HR systems through their APIs.
3. Build controls-as-code and policy-as-code where it fits — OPA and Rego, cloud configuration rules, CI/CD guardrails.
4. Write the scripting that holds it together, in Python or PowerShell, and build executive and operational dashboards in Power BI, Tableau or the platform's native reporting.
AI GOVERNANCE AND AI SECURITY
1. Establish AI governance programmes — AI use-case inventories, AI risk and impact assessments, model and agent registries, acceptable-use policy, and review and approval gates that do not stall the business.
2. Advise against ISO/IEC 42001, the NIST AI Risk Management Framework, EU AI Act obligations where they reach regional clients, and emerging UAE and GCC AI guidance.
3. Assess the security of AI, LLM and agentic systems — prompt injection, data leakage, tool and plugin permissioning, autonomy boundaries, model supply chain and retrieval data boundaries — referencing the OWASP Top 10 for LLM Applications and MITRE ATLAS.
4. Define controls for the privacy questions AI raises: training data pro
DATA SECURITY AND PRIVACY
1. Deliver privacy programmes end to end — data discovery and classification, data mapping, records of processing activities, data protection and privacy impact assessments, data flow diagrams, lawful basis and consent, and retention schedules.
2. Handle cross-border transfer assessments, data localisation requirements, data subject access request processes and breach notification procedures.
3. Advise on the technology that enforces it — DLP, DSPM, encryption and key management, tokenisation, data access governance and insider risk.
4. Act as outsourced or advisory Data Protection Officer for clients where the engagement calls for it.
CLIENT RELATIONSHIPS AND PRACTICE CONTRIBUTION
1. Own engagement delivery: scope, plan, quality, timeline and the client relationship.
2. Mentor consultants and analysts, and review their work before it leaves the building.
3. Support pre-sales — scoping calls, proposals, methodologies and client workshops.
4. Improve the practice through accelerators, templates, control libraries and internal training.
WHAT WE ARE LOOKING FOR
ESSENTIAL
1. Eight or more years in cybersecurity, with at least five in GRC, risk, audit or privacy consulting.
2. Demonstrable audit and assessment experience against the UAE Information Assurance Standards, ISO/IEC 27001 and the UAE PDPL, plus at least two other regional or sector frameworks.
3. Proven delivery of strategy, roadmap, blueprint or target operating model work — not assessments alone.
4. Strong command of the privacy artefacts: records of processing activities, impact assessments, data flow diagrams and data inventories.
5. Working knowledge of AI governance frameworks and of the security risks specific to LLM and agentic systems.
6. Enough grounding in the underlying technology — cloud on Azure and AWS, identity, network and endpoint security, SIEM — to challenge an engineer's answer rather than simply record it.
7. Excellent written English and the presence to hold a room of executives and regulators.
8. Bachelor's degree in information security, computer science, engineering or a related field.
DESIRABLE
1. Experience in a Big Four or specialist advisory firm, or in a regulator-facing role.
2. Hands-on GRC platform implementation or integration experience.
3. Scripting and automation ability — Python, PowerShell, REST API integration.
4. Exposure to OT and ICS governance, or to sector frameworks in aviation, healthcare or energy.
5. Arabic language skills, written or spoken.
6. Existing UAE residency and an established GCC client network.
CERTIFICATIONS
We look for a credible combination rather than a complete set. Candidates typically hold two or three of the following, with a clear plan for the rest.
• ISO/IEC 27001 Lead Auditor or Lead Implementer | Governance and assurance | Strongly preferred
• CISM, CRISC or CISA | Risk, audit and management | Strongly preferred
• CIPP/E, CIPM or CDPSE | Privacy | Preferred
• IAPP AIGP | AI governance | Preferred
• ISO/IEC 42001 Lead Auditor or Lead Implementer | AI management systems | Preferred
• ISO/IEC 27701 Lead Implementer | Privacy management systems | Advantageous
• CISSP | Broad security practice | Advantageous
• CCSK or CCSP | Cloud security | Advantageous
HOW THE PRACTICE WORKS
• Consultants here carry two or three concurrent engagements and are accountable for the quality of what goes out under their name.
• Peer review is mandatory on every client deliverable, and we are deliberate about writing reports that a non-technical audit committee can act on.
• We do not operate a billable-utilisation culture that squeezes out thinking time.
• A portion of your year is protected for research, certification and practice development, because the frameworks in this region change faster than the training market keeps up with — AI governance being the clearest current example.
WHAT WE OFFER
• Ownership of significant engagements with recognised regional clients from the first quarter.
• A practice that pairs advisory with genuine offensive and defensive capability, so your recommendations are validated rather than assumed.
• Funded certification and training, and a defined path to Principal Consultant and Practice Lead.
• Competitive tax-free package, medical cover, annual leave and air fare, and full visa sponsorship for you and your dependants.
SELECTION PROCESS
• Stage 1 — Screening call with the recruitment team, 30 minutes.
• Stage 2 — Technical interview with the Practice Lead covering frameworks, delivery history and a scenario walkthrough.
• Stage 3 — Short written exercise: a one-page assessment approach for a sample client scenario, reviewed and discussed rather than scored.
• Stage 4 — Final conversation with leadership on fit, package and start date.