Director - Security and Governance

Inception42, a G42 company, is the region’s leading innovator of AI-powered domain-specific as well as industry-agnostic products, built on a rich heritage of research and development. Within the G42 ecosystem, Inception functions as the core intelligence layer – transforming data and compute infrastructure into real-world, applied AI solutions. Beyond its commercial endeavors, Inception is committed to creating positive societal impact. For more information, please visit www.inception42.ai

Overview:

Inception42, a G42 company, is the region’s leading innovator of AI-powered domain-specific as well as industry-agnostic products, built on a rich heritage of research and development. Within the G42 ecosystem, Inception42 functions as the core intelligence layer – transforming data and compute infrastructure into real-world, applied AI solutions. Beyond its commercial endeavors, Inception42 is committed to creating positive societal impact. For more information, please visit www.inceptionai.ai

Set the direction for security and information security governance across Inception42’s enterprise platforms, cloud services, and product environments. You will own security strategy, risk oversight, control assurance, and security operations, translating business priorities and customer commitments into effective protection. This director role combines executive accountability with technical judgment: building a capable security function, directing investment, and ensuring that security controls work in production.

Responsibilities:

Define and deliver the security strategy, operating model, and prioritised roadmap. Align investment, staffing, tooling, and managed services with material risks, business priorities, and delivery needs.

• Own the information security governance framework, including policies, standards, control ownership, exceptions, and assurance. Maintain practical alignment with ISO 27001, NIST CSF, CIS, and applicable obligations.

• Direct security risk management across enterprise and product environments. Maintain a clear risk register, agree treatment with accountable owners, escalate residual exposure, and ensure risk acceptance follows defined decision authority.

• Provide executive reporting on security posture, material risks, control effectiveness, incident trends, remediation, and investment trade-offs. Make decisions and unresolved exposures clear and actionable.

• Lead the security team, setting responsibilities, performance expectations, development plans, and succession priorities. Build technical capability and accountability across internal teams and managed providers.

• Own security operations outcomes across monitoring, detection engineering, alert triage, investigation, and response. Set coverage and service expectations and challenge the effectiveness of SIEM, EDR, and detection controls.

• Direct the response to major security incidents, coordinating technical containment, investigation, recovery, stakeholder communication, and post-incident review. Ensure corrective actions are completed and validated.

• Govern vulnerability and exposure management, with risk-based prioritisation, accountable remediation owners, agreed service levels, exception handling, and escalation of overdue material risks.

• Own the security compliance and assurance programme, including applicable UAE requirements, ISO 27001 certification activities, customer security commitments, and internal and external audits through verified closure.

• Set security architecture and design review standards for cloud workloads, enterprise systems, and product initiatives. Partner with Engineering on identity, access, workload protection, secure delivery, and operational controls.

• Direct customer security assurance, due diligence, questionnaires, and evidence responses, ensuring commitments accurately reflect implemented controls and agreed remediation plans.

• Govern business continuity and disaster recovery with service owners, aligning recovery objectives, dependencies, failover arrangements, and exercises with business needs. Track test findings to closure.

• Manage security budgets, vendor performance, tooling value, and managed service outcomes. Use evidence of risk reduction and control effectiveness to guide procurement and renewal decisions.

• Build security awareness and shared accountability across the organisation. Embed security reviews and practical control ownership into platform, application, and product change.

Qualifications:

• Experience leading an information security function or a substantial security domain, with accountability for strategy, delivery, line management, and measurable improvements in security posture.

• Strong governance, risk, and compliance expertise, including ownership of policy and control frameworks aligned to ISO 27001, NIST CSF, or CIS, and delivery of audit or certification programmes.

• Proven ability to translate business priorities and risk exposure into a funded security roadmap, clear operating responsibilities, and effective internal and vendor delivery.

• Deep practical security operations experience, including SIEM and detection tuning, alert triage, EDR, major incident leadership, and the ability to challenge technical findings and recovery decisions.

• Experience governing vulnerability management, risk-based prioritisation, remediation commitments, control exceptions, and escalation across platform and application owners.

• Cloud security capability across Azure or AWS, including posture management, identity and access controls, workload protection, and secure architecture patterns.

• Credible executive and technical communication, with the judgment to explain trade-offs, escalate material exposure, and maintain security standards under delivery pressure.

• Relevant professional certification such as CISSP, CISM, or a recognised cloud or security architecture certification.

• Experience applying UAE security requirements and national frameworks in public-sector or regulated customer environments.

• Familiarity with Microsoft Sentinel, Defender XDR, Defender for Cloud, Purview, Entra ID, identity governance, and privileged access management.

• Experience with DevSecOps, secure SDLC, pipeline and container security, penetration testing, or threat modelling.

• Experience governing AI systems and data, including model, agent, and data protection risks, and leading continuity and recovery exercises.

Inception42 is building AI systems designed for practical deployment at scale — across industries, infrastructure, and national-level initiatives.

If you want to work close to both advanced AI capability and real-world execution, we’d like to hear from you.