Lead Cyber Security Engineer

"We are seeking a highly motivated and experienced hands-on technical security lead to build, run and test our security controls. You'll also lead compliance for a CBUAE-regulated insurer. This is not a strategy-only or GRC-only role. About 70% of your time goes on technical work. The other 30% goes on proving compliance, using the evidence your own work produces. If you are interested and meet the requirements please send your CV to hr@dubins.ae”  What you'll do 🔍 Run security operations. You'll be the in-house technical owner of our outsourced SOC (MSSP). That means challenging triage, building new detections (including insurance-specific threats such as claims fraud and health data exfiltration), running purple-team tests and leading major incidents. 🛡️ Own the core controls hands-on. This covers DLP (Purview/Forcepoint), Intune/MDM, patching, and vulnerability management from start to finish, prioritised by CVSS, EPSS and CISA KEV. 💻 Secure business applications. You'll work on policy, claims and underwriting platforms, ERP, portals, mobile apps and APIs. You'll set security requirements for vendors and give security sign-off before go-live. 🎯 Manage VAPT. You'll scope and commission tests, reproduce key findings yourself, and close findings only on evidence. ☁️ Harden endpoints, infrastructure and the network. This includes EDR/XDR, Azure/AWS/M365, Entra ID, PAM, zero trust, and firewall and WAF reviews. 📊 Lead GRC and reporting. You'll keep one audit gap tracker, maintain a unified control framework (ISO 27001, ADHICS, UAE IA, CBUAE, PDPL) and produce monthly metrics plus a quarterly cyber risk report for the Board. What you'll bring ✅ 8–12 years of hands-on cyber security engineering or operations experience ✅ A track record of managing an outsourced SOC, leading real incidents, running VAPT and vulnerability programmes, and closing audit findings ✅ ISO 27001 implementation or audit experience ✅ Direct experience with UAE regulators: CBUAE, UAE IA, DoH/ADHICS or DHA ✅ At least one hands-on technical certification, such as OSCP, GCIH, GCIA, GCFA, GPEN, AZ-500, or a firewall or EDR vendor cert (CISSP, CISM, CISA and similar are a plus but don't replace this) ✅ Scripting in PowerShell or Python for automation ✅ A Bachelor's degree in Computer Science, Information Security, Engineering or a related field Nice to have ➕ A background in insurance, takaful, brokers or TPAs (especially health insurance), or in CBUAE-regulated banking ➕ Exposure to DESC ISR, SAMA CSF or NCA ECC