Field of studyBusiness Management, Technology Management (or related)
Study levelMaster's
Original posting
*Role is for UAE Nationals only
Contribute to Group IT Risk and Cybersecurity at Emirates NBD Group as Specialist Technology Regulations & Business Management, supporting sound risk decisions, controlled exposures and timely remediation through risk assessments, portfolio reviews and control actions, sound controls and continuous improvement.
Key Tasks:-
Ensures proactive reach out and assists the business and regulators to identify opportunities and guidance from a security viewpoint. The role would lead the team to reach out and act as first contact towards the business to ensure security is perceived as an enabler.
Leads the team to align with business stakeholders on possible ways to meet security challenges and promote security awareness & risk culture across the organisation, creating a culture of business security champions. Ensures early involvement of security in business projects to avoid unnecessary rework or delays.
Tracks active risks via the IT Risk register and highlights the issues and the business impact on relevant stakeholders.
Is a part of the business unit team and acts in a consultative way to help the business improve its security posture and adhere to security policies and expected controls.
Educates and assists the business on data security controls with respect to regulations where Emirates NBD operates.
AI Governance: Designs, operationalizes and continuously improves the technology-risk elements of the Group AI governance framework, ensuring AI / GenAI / agentic AI use cases are inventoried, risk-tiered, assessed and controlled across their lifecycle in line with regulatory expectations and the Group's Responsible AI principles.
Regulatory Landscape & Horizon Scanning: Monitors, interprets and translates emerging technology, cyber, data, outsourcing, privacy and AI regulations (local and international) into actionable requirements, impact assessments and roadmaps for the business and Group IT.
Regulatory Team Transformation: Acts as a change agent in transforming the regulatory function from a manual, reactive, compliance-checking model to a data-driven, automated and advisory model, leveraging GRC platforms, analytics and AI-enabled tooling.
Support the team with external and internal audit requirements related to technology, security and data protection.
Responsibilities
Assess, track and maintain regulatory compliance across the Group (local & international)
Manage & implement local & international regulatory security standards where Emirates NBD operates
Maintain a Group-wide regulatory register mapped to policies, controls and control owners
Coordinate regulatory inspections, self-assessments and attestations, and track remediation to closure
Aligning the Group Information Security Strategy to Emirates NBD business strategy
Establish and operationalize AI Governance (technology & cyber risk)
Develop and maintain AI governance policies, standards, procedures and control frameworks aligned to ISO/IEC 42001, NIST AI RMF and applicable regulations
Run AI regulatory assessments covering security, privacy, data quality, bias & fairness, explainability, robustness, human oversight and third-party risk requirements
Partner with Model Risk Management, Data Governance, Data Protection, Compliance and Legal to ensure end-to-end AI lifecycle governance and monitoring
Provide technology-risk input to the AI Governance Committee
Regulatory horizon scanning and change management
Continuously monitor the evolving technology, cyber, data-privacy and AI regulatory landscape across the Group's jurisdictions
Perform regulatory gap and impact assessments; translate requirements into business and technical requirements, control changes and remediation roadmaps
Brief senior management and committees on upcoming regulatory changes and their business impact
Represent the Group in regulatory consultations, industry working groups and sandboxes where appropriate
Transform the regulatory function (Automation & analytics)
Define and deliver the regulatory team's transformation roadmap covering operating model, processes, tooling, data and skills
Implement and optimize GRC platforms (e.g. regulatory obligation mapping, control libraries, automated evidence collection)
Apply data analytics and approved AI technologies (e.g. GenAI for regulation summarization and mapping) to improve efficiency, with appropriate human review
Develop KRIs/KPIs and dashboards for regulatory and AI risk posture reporting
Coach and upskill team members on AI, regulatory and digital skills
Govern and track the IT Risk register
Track the IT Risk register to ensure risks are tracked to closure, including AI and emerging technology risks.
Highlight the business impact to senior stakeholders by extrapolating the risks from the register
Improve Security and Responsible AI Awareness across the Group
Identify, track and implement security KPIs across the organisation
Conduct security awareness sessions across the Group to improve risk culture and align with regulatory requirements for the geographies where Emirates NBD operates
Design and deliver awareness on safe and responsible use of AI, with acceptable-use and data-handling expectations
Build lasting relationships with technical and business stakeholders to create a coherent and collaborative environment that balances security and functionality, ensuring threats that affect customer or employee data are managed effectively while the business meets its agile and quick time-to-market strategy.
Partner with cross-functional core stakeholders within security, technology, Data & AI, business, risk, compliance & audit to influence regulatory direction and facilitate key decision points for inclusion within business requirements.
Communicate the impact of not including regulatory requirements to stakeholders both at the technical level (technology) and at the end-user level (business).
Act as an advisor to technology & business stakeholders by ensuring effective decision making using facts, regulatory knowledge and providing options for possible solutions to challenges.
Qualifications
Bachelor’s degree in information technology, Computer Science, Engineering, Law or Business (Master's degree in Business Management, Technology Management or equivalent preferred)
Executive education (e.g. Harvard, INSEAD) in AI strategy, digital transformation or risk management
At least one of: CISM, CISSP, CRISC, CGEIT
AI governance certification: IAPP AIGP, ISACA AAISM / AAIA, or ISO/IEC 42001 Lead Implementer / Lead Auditor
5-8 years' experience in information security, technology risk or technology regulatory compliance, of which at least 3 years in the financial services industry
Minimum 2 years' hands-on experience in AI governance, AI risk management, data governance (e.g. building AI policies, AI regulatory assessments)
Deep experience in implementing regulatory controls to ensure alignment of business and IT requirements, including translation of business requirements into security requirements (and vice versa)
Deep experience in communication and alignment with security teams and implementation teams
Deep expertise in the current regulatory agenda and corresponding assessment methodologies across GCC and international jurisdictions
Experience interacting with regulators (inspections, consultations, submissions) in the UAE / GCC
Experience contributing to or leading a transformation programme (operating model, process re-engineering, GRC implementation or automation)
3 to 5 years' experience of understanding the financial industry, market and specific operations that relate to banking & finance
UAE (primary)
CBUAE regulations and standards relevant to technology, cyber, outsourcing, operational resilience, consumer protection and enabling technologies (incl. AI/ML guidance)
UAE Information Assurance Regulation (formerly NESA); UAE Federal PDPL (Decree-Law 45/2021)
UAE National AI Strategy 2031 and UAE Charter for the Development & Use of AI; DIFC Data Protection Law (incl. Regulation 10 on autonomous systems) and ADGM requirements
GCC & international jurisdictions where the Group operates
KSA: SAMA Cyber Security Framework, NCA ECC, SDAIA AI Ethics Principles and KSA PDPL
Other: RBI (incl. AI / FREE-AI framework) and India DPDP Act; MAS TRM, FEAT principles and AI risk management guidance; CBE (Egypt); BDDK / KVKK (Türkiye); CBB (Bahrain); UK PRA / FCA
EU AI Act, GDPR, DORA and NIS2 (for extraterritorial impact and industry benchmarking)
Standards & frameworks
ISO/IEC 42001 (AI management system), ISO/IEC 23894 (AI risk), NIST AI RMF (incl. Generative AI profile), OECD AI Principles
Knowledge of security controls, typical pitfalls and required measures for security compliance; deep experience of the current technology backbone and available technologies within the security space
Deep knowledge of the interface to implementation, including development methodologies (Agile, DevSecOps / MLOps) and latest market trends and their possible application to the bank
Hands-on experience with GRC platforms and continuous control monitoring
AI & Data
Understanding of AI / ML, Generative AI and agentic AI concepts, sufficient to challenge design and controls
Knowledge of AI-specific risks and controls: bias & fairness, explainability, robustness, hallucination, prompt injection, data leakage, model/data poisoning, human oversight and AI supply-chain / third-party risk
Data governance, data privacy (privacy-by-design, DPIAs) and data lineage principles
Data analytics and visualization skills (e.g. Power BI, Excel, SQL) and practical, responsible use of GenAI tools for regulatory analysis
Managerial
Change management and transformation skills: ability to define target operating models, redesign processes and drive adoption
Deep knowledge of current business priorities and projects and corresponding business goals
Collaborative leadership style that involves a mix of resource & project planning along with delegation, decision making & conflict resolution
Superior verbal & written communication skills, including the ability to explain complex AI and regulatory topics to Board / senior management
Security and AI vendor contract management (incl. AI-specific contractual clauses)
Negotiation skills
#LI-SA1
ENBD
Meet the leading banking group in the region
Emirates NBD, the leading Banking Group in the MENAT region, was formed on 19 June 1963, when H.H. Late Sheikh Rashid bin Saeed Al Maktoum signed the Charter of Incorporation of the National Bank of Dubai (NBD) which became the first National Bank established in Dubai and the United Arab Emirates (UAE). With the blessings of H.H. Sheikh Mohammed bin Rashid Al Maktoum, Vice President and Prime Minister of the UAE and Ruler of Dubai, NBD merged with Emirates Bank International (EBI) on 06 March 2007, to form Emirates NBD, the largest banking group in the region by assets. On 16 October 2007, the shares of Emirates NBD were officially listed on the Dubai Financial Market (DFM). The merger between EBI and NBD to create Emirates NBD, became a regional consolidation blueprint for the banking and finance sector as it combined the second and fourth largest banks in the UAE to form a banking champion capable of delivering enhanced value across Corporate, Retail, Islamic, Investment, and Private Banking, Global Markets & Treasury, Asset Management and Brokerage operations throughout the region.
Specialist Technology Regulations & Business Management at Emirates NBD — BranchFactor