Deputy Regional Information Security Officer

Payward (parent company behind Kraken, NinjaTrader, Breakout, xStocks, Payward Services and CF Benchmarks) is seeking a Deputy Regional Information Security Officer to own ICT security, operational resilience, and regulatory compliance across a portfolio of entities at different stages of maturity. The role is a high-visibility, high-trust position with accountability to entity boards and regulators. The team is remote-first and international.

Responsibilities

Serve as the named ICT security officer for appointed entities with formal accountability for security risk, ICT governance, and resilience oversight at board level; Prepare and present security, risk, and resilience materials to entity boards; Act as primary point of contact for VARA and other relevant regulatory authorities on ICT and security matters; Support entity go-live processes by implementing and localizing group ICT governance frameworks; Lead ICT and security risk assessments and escalate material risks; Maintain and adapt entity-level policies and procedures; Coordinate control testing, evidence documentation, and audit preparation; Manage classification, escalation, and regulatory reporting of ICT-related incidents; Lead business impact assessments, critical function mapping, and business continuity planning; Oversee continuity and recovery testing; Maintain oversight of ICT third-party dependencies and outsourcing arrangements; Act as key local liaison between UAE entities, the RISO team, Group Security, and Compliance; Drive local implementation of group frameworks, policies, and resilience standards; Execute risk assessments and control testing in line with VARA cybersecurity guidelines; Support responses to regulatory examinations; Participate in remediation planning for audit findings; Participate in regional incident response process

Requirements

7+ years of experience in information security governance, ICT risk management, or regulatory compliance in a regulated financial services, fintech, or virtual asset environment; Direct experience as a named regulatory contact, involvement in regulatory examinations, supervisory interactions, licensing processes, or equivalent; Familiarity with UAE regulatory frameworks; Demonstrated ability to implement, adapt, and maintain compliance or governance frameworks within a regulated environment; Experience conducting risk assessments, business impact analyses, and resilience planning at the entity level; Familiarity with ICT outsourcing and third-party risk management within group structures; Ability to translate technical risk into board-level narrative and regulatory-grade documentation; Comfortable operating across multiple jurisdictions simultaneously, each at a different stage of regulatory maturity; Strong project management skills and the ability to drive outcomes across cross-functional, globally distributed teams

Nice to have

Experience with VARA or other virtual asset / crypto-native regulatory regimes (significant advantage, strongly preferred); Certifications such as CISSP, CISM, CRISC, CISA, or ISO27001 Lead Implementer; Familiarity with EU frameworks such as DORA and MiCA (strongly preferred)