Specialist Technology Regulations & Business Management (UAE National Role)

*Role is for UAE Nationals only

Contribute to Group IT Risk and Cybersecurity at Emirates NBD Group as Specialist Technology Regulations & Business Management, supporting sound risk decisions, controlled exposures and timely remediation through risk assessments, portfolio reviews and control actions, sound controls and continuous improvement.

Key Tasks:-

Ensures proactive reach out and assists the business and regulators to identify opportunities and guidance from a security viewpoint. The role would lead the team to reach out and act as first contact towards the business to ensure security is perceived as an enabler.

Leads the team to align with business stakeholders on possible ways to meet security challenges and promote security awareness & risk culture across the organisation, creating a culture of business security champions. Ensures early involvement of security in business projects to avoid unnecessary rework or delays.

Tracks active risks via the IT Risk register and highlights the issues and the business impact on relevant stakeholders.

Is a part of the business unit team and acts in a consultative way to help the business improve its security posture and adhere to security policies and expected controls.

Educates and assists the business on data security controls with respect to regulations where Emirates NBD operates.

AI Governance:Designs, operationalizes and continuously improves the technology-risk elements of the Group AI governance framework, ensuring AI / GenAI / agentic AI use cases are inventoried, risk-tiered, assessed and controlled across their lifecycle in line with regulatory expectations and the Group's Responsible AI principles.

Regulatory Landscape & Horizon Scanning:Monitors, interprets and translates emerging technology, cyber, data, outsourcing, privacy and AI regulations (local and international) into actionable requirements, impact assessments and roadmaps for the business and Group IT.

Regulatory Team Transformation:Acts as a change agent in transforming the regulatory function from a manual, reactive, compliance-checking model to a data-driven, automated and advisory model, leveraging GRC platforms, analytics and AI-enabled tooling.

Support the team with external and internal audit requirements related to technology, security and data protection.

Assess, track and maintain regulatory compliance across the Group (local & international)

Manage & implement local & international regulatory security standards where Emirates NBD operates

Maintain a Group-wide regulatory register mapped to policies, controls and control owners

Coordinate regulatory inspections, self-assessments and attestations, and track remediation to closure

Aligning the Group Information Security Strategy to Emirates NBD business strategy

Establish and operationalize AI Governance (technology & cyber risk)

Develop and maintain AI governance policies, standards, procedures and control frameworks aligned to ISO/IEC 42001, NIST AI RMF and applicable regulations

Run AI regulatory assessments covering security, privacy, data quality, bias & fairness, explainability, robustness, human oversight and third-party risk requirements

Partner with Model Risk Management, Data Governance, Data Protection, Compliance and Legal to ensure end-to-end AI lifecycle governance and monitoring

Provide technology-risk input to the AI Governance Committee

Regulatory horizon scanning and change management

Continuously monitor the evolving technology, cyber, data-privacy and AI regulatory landscape across the Group's jurisdictions

Perform regulatory gap and impact assessments; translate requirements into business and technical requirements, control changes and remediation roadmaps

Brief senior management and committees on upcoming regulatory changes and their business impact

Represent the Group in regulatory consultations, industry working groups and sandboxes where appropriate

Transform the regulatory function (Automation & analytics)

Define and deliver the regulatory team's transformation roadmap covering operating model, processes, tooling, data and skills

Implement and optimize GRC platforms (e.g. regulatory obligation mapping, control libraries, automated evidence collection)

Apply data analytics and approved AI technologies (e.g. GenAI for regulation summarization and mapping) to improve efficiency, with appropriate human review

Develop KRIs/KPIs and dashboards for regulatory and AI risk posture reporting

Coach and upskill team members on AI, regulatory and digital skills

Govern and track the IT Risk register

Track the IT Risk register to ensure risks are tracked to closure, including AI and emerging technology risks.

Highlight the business impact to senior stakeholders by extrapolating the risks from the register

Improve Security and Responsible AI Awareness across the Group

Identify, track and implement security KPIs across the organisation

Conduct security awareness sessions across the Group to improve risk culture and align with regulatory requirements for the geographies where Emirates NBD operates

Design and deliver awareness on safe and responsible use of AI, with acceptable-use and data-handling expectations

Build lasting relationships with technical and business stakeholders to create a coherent and collaborative environment that balances security and functionality, ensuring threats that affect customer or employee data are managed effectively while the business meets its agile and quick time-to-market strategy.

Partner with cross-functional core stakeholders within security, technology, Data & AI, business, risk, compliance & audit to influence regulatory direction and facilitate key decision points for inclusion within business requirements.

Communicate the impact of not including regulatory requirements to stakeholders both at the technical level (technology) and at the end-user level (business).

Act as an advisor to technology & business stakeholders by ensuring effective decision making using facts, regulatory knowledge and providing options for possible solutions to challenges.

Bachelor’s degree in information technology, Computer Science, Engineering, Law or Business (Master's degree in Business Management, Technology Management or equivalent preferred)

Executive education (e.g. Harvard, INSEAD) in AI strategy, digital transformation or risk management

At least one of: CISM, CISSP, CRISC, CGEIT

AI governance certification: IAPP AIGP, ISACA AAISM / AAIA, or ISO/IEC 42001 Lead Implementer / Lead Auditor

ISO/IEC 27001 Lead Implementer / Lead Auditor

Privacy certification (e.g. CIPP/E, CIPM, CDPSE)

Cloud security certification (e.g. CCSK, CCSP); PCI QSA / PCI DSS v4.0 knowledge

5-8 years' experience in information security, technology risk or technology regulatory compliance, of which at least 3 years in the financial services industry

Minimum 2 years' hands-on experience in AI governance, AI risk management, data governance (e.g. building AI policies, AI regulatory assessments)

Deep experience in implementing regulatory controls to ensure alignment of business and IT requirements, including translation of business requirements into security requirements (and vice versa)

Deep experience in communication and alignment with security teams and implementation teams

Deep expertise in the current regulatory agenda and corresponding assessment methodologies across GCC and international jurisdictions

Experience interacting with regulators (inspections, consultations, submissions) in the UAE / GCC

Experience contributing to or leading a transformation programme (operating model, process re-engineering, GRC implementation or automation)

3 to 5 years' experience of understanding the financial industry, market and specific operations that relate to banking & finance

UAE (primary)

• CBUAE regulations and standards relevant to technology, cyber, outsourcing, operational resilience, consumer protection and enabling technologies (incl. AI/ML guidance)
• UAE Information Assurance Regulation (formerly NESA); UAE Federal PDPL (Decree-Law 45/2021)
• UAE National AI Strategy 2031 and UAE Charter for the Development & Use of AI; DIFC Data Protection Law (incl. Regulation 10 on autonomous systems) and ADGM requirements
• GCC & international jurisdictions where the Group operates
• KSA: SAMA Cyber Security Framework, NCA ECC, SDAIA AI Ethics Principles and KSA PDPL
• Other: RBI (incl. AI / FREE-AI framework) and India DPDP Act; MAS TRM, FEAT principles and AI risk management guidance; CBE (Egypt); BDDK / KVKK (Türkiye); CBB (Bahrain); UK PRA / FCA
• EU AI Act, GDPR, DORA and NIS2 (for extraterritorial impact and industry benchmarking)
• Standards & frameworks
• ISO/IEC 42001 (AI management system), ISO/IEC 23894 (AI risk), NIST AI RMF (incl. Generative AI profile), OECD AI Principles
• ISO/IEC 27001:2022, NIST CSF 2.0, PCI DSS v4.0, SWIFT CSCF, CSA Cloud Controls Matrix

Technical

• Deep knowledge of regulatory frameworks and how to embed them into business requirements
• Solid technical background covering heterogeneous technologies and multiple security domains (cloud, application, data, identity, network)
• Knowledge of security controls, typical pitfalls and required measures for security compliance; deep experience of the current technology backbone and available technologies within the security space
• Deep knowledge of the interface to implementation, including development methodologies (Agile, DevSecOps / MLOps) and latest market trends and their possible application to the bank
• Hands-on experience with GRC platforms and continuous control monitoring

AI & Data

• Understanding of AI / ML, Generative AI and agentic AI concepts, sufficient to challenge design and controls
• Knowledge of AI-specific risks and controls: bias & fairness, explainability, robustness, hallucination, prompt injection, data leakage, model/data poisoning, human oversight and AI supply-chain / third-party risk
• Data governance, data privacy (privacy-by-design, DPIAs) and data lineage principles
• Data analytics and visualization skills (e.g. Power BI, Excel, SQL) and practical, responsible use of GenAI tools for regulatory analysis

Managerial

• Change management and transformation skills: ability to define target operating models, redesign processes and drive adoption
• Deep knowledge of current business priorities and projects and corresponding business goals
• Collaborative leadership style that involves a mix of resource & project planning along with delegation, decision making & conflict resolution
• Superior verbal & written communication skills, including the ability to explain complex AI and regulatory topics to Board / senior management
• Good presentation skills
• Business, Technical & Audit Stakeholder Management skills
• Security and AI vendor contract management (incl. AI-specific contractual clauses)
• Negotiation skills
• #LI-SA1