Job Description

Operating in the UAE for over 50 years, CBD manages the financial requirements of some of the largest corporates and businesses operating in the country, driving the UAE economy. Over the years, CBD has transformed into a progressive and modern banking institution winning multiple awards for its digital initiatives, credit cards, bank accounts, mobile app features and services.

CBD has been recognized as the number one bank in the UAE on the Forbes list of The World’s Best Banks 2022.

As we continue to build upon our successes, we are looking for ambitious individuals who are passionate about the banking and finance industry and the markets in which CBD operates. Just as important to us is your ability to demonstrate a talent for dealing with people - your colleagues and our customers and delivering service that really goes the extra mile.

Job Purpose: To manage Identity and Access Management governance and oversight within the CISO Office as a second line of defence function. The role supports the development and maintenance of IAM strategy, policies, standards, risk oversight and the target operating model across human, privileged, non-human and AI-agent identities. It provides independent review, challenge and monitoring of first-line IAM implementation and operations, helping ensure that access is governed throughout its lifecycle and remains least privileged, traceable, resilient and aligned with the Bank’s risk appetite and regulatory requirements.

Principal Accountabilities:

• Manage the IAM governance and oversight activities performed by the CISO Office and support the development, implementation and periodic review of the Bank’s IAM strategy, policies, standards, risk framework and roadmap.
• Provide independent second-line oversight, advice and challenge over first-line IAM design, implementation and operation.
• Maintain clear separation between CISO Office oversight and first-line ownership of IAM platforms, administration and control execution.
• Manage team performance and support the continued development of IAM capability and sustainable governance practices.
• Support the development and maintenance of the enterprise IAM operating model, with clear accountability across Business, Technology, Human Resources and Risk. Monitor implementation of agreed responsibilities and escalate material gaps or areas of unclear ownership.
• Develop, maintain and monitor compliance with standards for identity lifecycle management, least privilege, access models, segregation of duties, privileged access, recertification and timely access removal.
• Independently review role models, security matrices, control designs, exceptions and risk acceptances.
• Develop and maintain control-testing and continuous-monitoring requirements, track remediation of identified weaknesses and escalate material or overdue issues.
• Develop and maintain IAM security principles and minimum requirements across identity governance, authentication, privileged access, directories, cloud, customer and machine identities.
• Review and challenge IAM controls for new platforms, applications, cloud services and material changes.
• Oversee application onboarding to IAM and IGA platforms through governance gates and independent control validation, while Technology retains delivery and operational accountability.
• Maintain and monitor the IAM roadmap and provide risk-based input and challenge regarding investment, architecture and automation priorities.
• Develop, implement and maintain governance requirements for AI agents, service accounts, workloads, bots, APIs and other non-human identities.
• Require unique identities, defined purposes, risk classification, accountable owners and controlled lifecycles.
• Set requirements for approvals, credentials, delegated authority, time-bound access, monitoring, suspension and decommissioning.
• Oversee agent access controls, human approval gates and auditable activity in coordination with AI Governance, Data, Privacy and Technology stakeholders.
• Maintain the IAM risk profile, including control effectiveness, residual risk, exceptions and remediation priorities.
• Support the translation of regulatory, policy and risk-appetite requirements into IAM controls, Key Risk Indicators and oversight plans.
• Coordinate CISO Office engagement on IAM audits and regulatory reviews, supporting accurate findings, complete evidence and clear first-line ownership.
• Review exceptions and risk acceptances, escalating material or overdue exposures.
• Oversee IAM resilience, recovery, incident readiness and emergency-access arrangements.
• Must be available to provide out-of-hours and weekend support when required for material IAM incidents, urgent risk matters, regulatory requests or critical business events.
• Report IAM risks, KRIs, control effectiveness, access-review outcomes, exceptions and transformation progress.
• Provide independent, risk-based advice and constructive challenge to relevant stakeholders and management.
• Develop and maintain IAM supplier control requirements and monitor material service, control and concentration risks.
• Maintain authoritative IAM policies, standards, risk assessments and governance records.

Requirements

Education and Experience:

• Bachelor’s degree in information security, Cybersecurity, Computer Science, Information Technology, Engineering, Risk Management or a related discipline; a relevant postgraduate qualification is advantageous.
• Professional certification in identity, cybersecurity or technology risk, such as CISSP, CISM, CRISC, CCSP or a recognised IAM/IGA/PAM certification, is preferred.
• Typically, 8–12 years of relevant experience across IAM, cybersecurity, technology risk or control functions, including experience managing IAM governance, assurance or oversight activities within banking or another regulated environment.
• Demonstrated experience managing or supporting IAM governance and oversight within a second-line, security-risk or equivalent independent control function, with a strong understanding of first-line technology and operational delivery.
• Experience contributing to the development and implementation of IAM strategy, policies, control frameworks, target operating models, responsibility-assignment arrangements and transition roadmaps across organisational boundaries.
• Strong practical knowledge of IGA, PAM, access management, federation, SSO, MFA/passwordless authentication, directories, identity lifecycle, RBAC/ABAC, segregation of duties, APIs and cloud/workload identity.
• Experience assessing non-human identities, service principals or AI agents, including credential management, delegated authorization, traceability, monitoring and lifecycle controls.
• Experience in risk assessment, independent challenge, control testing, audit and regulatory engagement, remediation tracking, management reporting and effective stakeholder engagement.
• Strong knowledge of banking operations, information security, privacy, resilience and regulatory expectations relevant to identity and access management.