Information Security Professional

ZainTECH is hiring an on-site, full-time Information Security Professional in Amman. The CISO Office role reviews SOC and vulnerability-team outputs, assigns risk ownership, follows remediation and maintains security/compliance evidence.

Review incident classification, severity, business impact, affected assets and root causes; escalate significant events and coordinate containment, recovery and corrective work. Analyze recurring patterns, improve controls/detection/playbooks and maintain post-incident reviews and the incident register.

Assess vulnerability-scan coverage across endpoints, servers, networks, applications and cloud; prioritize by risk, asset criticality, exploitability and threat intelligence. Assign and track remediation/deadlines, review penetration tests, validate fixes and document exceptions.

Review user, privileged and third-party access, PAM/MFA gaps, endpoint protection, encryption and hardening, firewall/VPN/IDS/IPS rules and network segmentation. Assess Microsoft 365/Azure/AWS posture with CSPM, security in system onboarding/change approval and DLP alerts.

Maintain assigned risk/treatment records and ISO27001/internal-audit/client evidence; assess suppliers and answer due-diligence questionnaires. Support regional compliance in UAE, Saudi Arabia, Kuwait, Jordan, Egypt and India, including UAE information-assurance standards, NCA, CITRA, Jordanian/Egyptian/Indian data laws, CERT-In directions and UAE/KSA privacy regulations.

Support ROPA records covering purposes, data/data-subject categories, legal bases, retention, recipients and systems. Maintain PIA/DPIA controls, inventories, flow maps and cross-border transfers; review classification, minimisation, retention/disposal, consent, access and encryption. Support timely access/correction/deletion requests, breach assessment/notifications with Legal and Data Protection, processor agreements and transfer safeguards.

Run BIA interviews/workshops to identify critical services and dependencies, assess disruption and recommend MTPD/RTO/RPO. Develop ISO22301-aligned continuity/recovery plans, support exercises and disaster-recovery tests and close improvements. Deliver phishing simulations, analyze results, provide Arabic/English awareness training and answer employee security queries.

Requirements: two to four years in information/IT security, SOC or a related technical role, including incident/vulnerability-report analysis; ISO27001:2022, NIST CSF2.0, CIS Controls and ITIL incident/change knowledge; privacy controls/laws and BIA/continuity/RTO/RPO understanding; GCC/Middle East or telecom/technology experience; a relevant Information Security/Computer Science/IT bachelor’s; and mandatory fluent Arabic and English.

At least one of Security+, CySA+, CEH, GIAC, GSEC or Microsoft SC-200 is required. The source additionally lists cloud certifications such as AZ-500/AWS Security Specialty, network credentials such as CCNA/Fortinet NSE/Palo Alto PCNSA, and ITIL Foundation, ISO22301 Foundation/Lead Implementer or privacy credentials such as IAPP CIPT/ISACA CDPSE; these additional groups are not labelled optional.

Apply through the linked ZainTECH portal. No numeric salary or deadline is specified.