Senior Security Assurance Analyst

Job Description

1. JOB PURPOSE Develop, implement, lead and continuously improve the security verification and testing processes consisting of but not limited to risk assessments, compliance reviews, vulnerability assessments and penetration tests based on industry best practices and as defined by the assurance. Collaborate with the team in developing the assurance program on an ongoing basis to incorporate industry best practices, offensive and defensive attack techniques. 0. JOB ACCOUNTABILITIES LINKED TO OBJECTIVE AREAS 0. Represent Cybersecurity assurance capabilities within the agile process as well as drive Cybersecurity best practices across the Emirates Group by executing in-depth automated and manual discovery of security vulnerabilities in web applications, mobile applications, web services and client server application and associated infrastructure 1. Research, recommend and implement formal methodologies and tools for conducting technical Cyber security risk assessments, reviews, and investigations. Perform impact analysis to achieve the security-by-design objective. 2. Monitor and continuously review the Emirates systems on an on-going basis, in compliance with the Emirates Group’s Cybersecurity Policies, Principles and Standards. Initiate corrective actions in the event of any violations to aid effective risk-based decision making supported with data. 3. Plan and schedule regular vulnerability assessments, penetration tests, technical risk assessments and compliance reviews on the Group’s Key IT infrastructure components and applications based on the criticality and perceived risk of the applications/services. 4. Ensure all the identified security weaknesses and risks are managed through their life cycle via product backlogs to ensure developments teams have a clear prioritization or can triage issues on a timely basis by providing knowledge transfer to the agile teams using meetings, walkthroughs, technical discussions, etc. 5. Develop documentation and a knowledge base to be used by developers for implementing Secure coding practices & provide recommendations for missing application & infrastructure security controls to facilitate secure-by-design culture. 6. Provide necessary knowledge transfer of the vulnerabilities found during the assessments to the software engineering teams by means of meetings, walkthroughs, technical discussions etc. for implementing appropriate security fixes. 7. Collaborate with development teams on improving security by offering design reviews, threat modelling, awareness, training, new tooling and expert review 8. Create tools, script, automation to make the vulnerability discovery and vulnerability management process more consistent, repeatable and increase efficiency.