Senior IT Risk Specialist

We're Hiring: Senior IT Risk SpecialistLocation: United Arab Emirates (Remote)Employment Type: Full-TimeExperience Level: SeniorWork Arrangement: Fully RemoteAbout UsWe are a globally focused organization committed to strengthening technology resilience, information security, enterprise risk management, and operational performance across diverse digital environments. Our teams collaborate across Information Technology, Cybersecurity, Enterprise Risk, Compliance, Internal Audit, Engineering, Infrastructure, Data, and business functions to identify technology risks and maintain a resilient operating environment.
Our risk teams combine structured risk assessment, control evaluation, quantitative and qualitative analysis, governance, and continuous monitoring to help the organization understand technology exposure and make informed decisions about risk treatment and investment.
The RoleWe are seeking an experienced Senior IT Risk Specialist to lead information-technology risk identification, assessment, monitoring, reporting, control evaluation, remediation, and governance activities across the organization's technology environment.
The ideal candidate will provide independent and risk-based oversight of IT risks covering infrastructure, applications, cloud, cybersecurity, data, third parties, technology operations, resilience, and transformation initiatives, while working closely with technology and business leaders to strengthen controls and reduce material risk exposure.

Key Responsibilities
Develop and implement IT risk-management strategies, frameworks, policies, standards, and procedures.
Maintain a comprehensive IT risk-management framework aligned with enterprise risk-management objectives.
Identify and assess technology risks across applications, infrastructure, cloud, networks, data, cybersecurity, operations, and third-party services.
Conduct risk assessments for new technologies, systems, applications, projects, vendors, and business inherent and residual technology risk using defined assessment methodologies.
Develop and maintain IT risk registers covering identified risks, owners, controls, ratings, treatment plans, and target risk assessments with technology owners, business stakeholders, security teams, and control owners.
Analyze technology risks based on likelihood, impact, asset criticality, threat exposure, vulnerability, and control effectiveness.
Establish appropriate risk-rating criteria and escalation thresholds.
Monitor changes in IT risk exposure and identify emerging risks requiring management attention.
Evaluate the effectiveness of technology controls in mitigating identified risks.
Identify control gaps, weaknesses, exceptions, and areas of excessive risk exposure.
Coordinate development and implementation of risk-treatment and remediation plans.
Track technology-risk remediation activities through closure.
Validate remediation actions and assess whether residual risk has been appropriately reduced.
Monitor overdue risk treatments and elevate significant delays or unresolved exposures.
Review and challenge risk acceptance requests, compensating controls, and risk exceptions.
Maintain a structured technology-risk exception and waiver process.
Ensure risk acceptances have appropriate ownership, justification, duration, approval, and review requirements.
Assess IT risks associated with cloud migration, digital transformation, application modernization, and technology implementation programs.
Support risk assessments for artificial intelligence, automation, emerging technologies, and new digital services.
Evaluate risks associated with cybersecurity threats, vulnerabilities, security incidents, and technology weaknesses.
Coordinate with Information Security teams to understand cyber-risk exposure and control effectiveness.
Assess identity and access-management risks, including privileged access, authentication, authorization, and access lifecycle controls.
Evaluate infrastructure and network risks, including availability, capacity, configuration, resilience, and security.
Assess application risks covering software development, change management, architecture, interfaces, dependencies, and application security.
Evaluate data risks involving confidentiality, integrity, availability, classification, privacy, retention, and data loss.
Assess technology resilience, business continuity, disaster recovery, backup, and recovery capabilities.
Evaluate IT service-management risks involving incident, problem, change, configuration, release, and service-level management.
Assess risks associated with technology outsourcing, managed services, cloud providers, SaaS platforms, and other third parties.
Coordinate with Third-Party Risk Management teams to assess supplier technology and cybersecurity risks.
Review supplier security assessments, audit reports, certifications, penetration-testing reports, and remediation commitments.
Assess risks arising from technology dependencies, concentration, single points of failure, and critical s