Lead - Security Governance and Assurance

Inception42, a G42 company, is the region’s leading innovator of AI-powered domain-specific as well as industry-agnostic products, built on a rich heritage of research and development. Within the G42 ecosystem, Inception functions as the core intelligence layer – transforming data and compute infrastructure into real-world, applied AI solutions. Beyond its commercial endeavors, Inception is committed to creating positive societal impact. For more information, please visit www.inception42.ai

Overview:

Inception42, a G42 company, is the region’s leading innovator of AI-powered domain-specific as well as industry-agnostic products, built on a rich heritage of research and development. Within the G42 ecosystem, Inception42 functions as the core intelligence layer – transforming data and compute infrastructure into real-world, applied AI solutions. Beyond its commercial endeavors, Inception42 is committed to creating positive societal impact. For more information, please visit www.inceptionai.ai

Lead security governance and assurance with identity and access management as the primary technical focus. Own the access model, policies, controls, and evidence used by auditors, regulators, and customers. Act as the hands-on identity design authority, guide engineers and analysts, and manage identity tooling and vendors, working with Information Security, Platform Engineering, Application Support, Internal Audit, HR, and system owners.

Responsibilities:

• Own the identity and access management strategy and roadmap, covering joiner-mover-leaver lifecycle, authentication, authorisation, privileged access and federation.

• Design and maintain the organisation's role-based access control model, including role definitions, entitlement structures and segregation of duties, and keep it workable as the business changes.

• Own access governance, including periodic access reviews and certification, entitlement recertification, and evidence that least privilege is applied in practice rather than in policy.

• Set the standards and patterns for privileged access management across infrastructure, applications and endpoints, including endpoint privilege management and the removal of standing local administrator rights, so that elevation is controlled, time-bound and auditable.

• Optimise existing privileged access tooling and make an evidence-based case for change where it limits required controls.

• Define how applications integrate with identity, covering SSO, SAML, OAuth and OIDC, Conditional Access and modern authentication, and review integrations against those standards before they go live.

• Automate identity lifecycle and access provisioning to reduce manual effort and the errors that come with it.

• Own the security governance framework for the domain, including policies, standards and control definitions mapped to ISO 27001, NIST CSF and applicable UAE requirements.

• Lead assurance activity across control testing, internal and external audit, and customer security due diligence, and drive findings through to closure.

• Provide security review and design authority for new systems, cloud workloads and acquisitions, with particular attention to how identity and access are handled.

• Define and report identity and access metrics, including privileged account inventory, standing administrator rights, orphaned and dormant accounts, review completion, provisioning performance and exceptions.

• Mentor engineers and analysts, and raise the standard of identity practice across the wider technology function.

• Within six months, assess privileged, dormant, standing, and endpoint administrator access; prioritise and close the most material risks; agree the target RBAC model; and establish evidenced access reviews and integration standards.

• Within twelve months, implement RBAC and segregation of duties across priority systems; reduce standing privilege through time-bound, auditable access; automate identity lifecycle; close audit findings without recurrence; and use routine metrics and knowledge sharing to improve identity capability.

Qualifications:

• Deep, hands-on expertise across enterprise identity and access management, covering identity governance and administration, single sign-on, multi-factor authentication, and privileged access management across both infrastructure and endpoints.

• Has designed and implemented an RBAC model at enterprise scale, including role engineering, entitlement design and segregation of duties, and made it work operationally.

• Strong Microsoft Entra ID capability, including Conditional Access, Privileged Identity Management, hybrid identity and application registration.

• Practical experience of at least one enterprise IGA platform, such as SailPoint, Saviynt or an equivalent, including access certification campaigns and lifecycle automation.

• Security governance and assurance capability. Has written policies and control standards against ISO 27001 or NIST, and taken them through internal and external audit successfully.

• Federation and modern authentication protocols in depth, including SAML, OAuth 2.0 and OIDC, with the judgement to review an application integration critically.

• Has acted as a technical design authority or senior technical lead, setting standards that others follow and defending them when challenged.

• Communicates access risk clearly to engineers, auditors and business stakeholders, and can explain why a control matters without relying on the policy alone.

• Privileged and endpoint privilege management tooling, including ManageEngine PAM360, Application Control Plus, and endpoint privilege controls. Experience of CyberArk, BeyondTrust, or Microsoft Intune EPM is equally relevant.

• Identity lifecycle automation and scripting, including PowerShell and integration with HR systems as the source of identity.

• Experience of UAE regulatory requirements and of public sector or regulated customer environments.

• Identity integration during mergers, acquisitions or organisational restructuring.

• Cloud security posture and workload identity in Azure or AWS, including service principals, managed identities and secrets management.

• Relevant certification such as CISSP, CISM, Microsoft Identity and Access Administrator, or an ISO 27001 lead auditor qualification.

• Governance of access to AI systems and data, including agent and service identity.

Inception42 is building AI systems designed for practical deployment at scale — across industries, infrastructure, and national-level initiatives.

If you want to work close to both advanced AI capability and real-world execution, we’d like to hear from you.