Senior Information Security Manager - Governance, Risk & Compliance

INSPIRE | EXHILARATE | DELIGHT

For over six decades, Chalhoub Group has been a partner and creator of luxury experiences in the Middle East. The Group, in its endeavour to excel as a hybrid retailer, has reinforced its distribution and marketing services with a portfolio of eight owned brands and over 300 international brands in the luxury, beauty, fashion, and art de vivre categories. More recently, the Group expanded its expertise into new categories of luxury watches, jewellery, and eyewear.
Every step at Chalhoub Group is taken with the customer at heart. Be it constantly reinventing itself or focusing on innovation to provide luxury experiences at over 750+ experiential retail stores, online and through mobile apps, each touch point leads to delighting the customer.

The Information Security Governance, Risk, and Compliance (IS GRC) Senior Manager will be responsible for building, developing, and managing the Group's Information Security GRC function. This critical function will deliver and maintain key governance, risk, and compliance activities, including the management of ISO27001, PCI DSS, Supplier Assurance, and associated risk management initiatives. The ISMS supports a diverse set of complex IT environments and business processes.

Reporting to the Director of Information Security, the IS GRC Senior Manager will collaborate closely with key stakeholders across the business, suppliers, and Technology teams to implement industry best practices, maintain certifications, and assure controls that protect critical information assets. The role requires a proven leader with expertise in designing and embedding effective governance, risk management, and compliance programs across a global organization.

Key Responsibilities:

Governance

• Develop and Lead the IS GRC Function
  • Build and manage a Group-wide Information Security GRC function to establish and enforce governance practices that align with organizational goals and regulatory requirements.
  • Lead the development and ongoing maintenance of an Information Security Management System (ISMS) compliant with ISO27001:2022, PCI DSS, and other frameworks.
• Policy Development and Implementation
  • Create and maintain robust information security policies, standards, and procedures, ensuring alignment with the organization's operational and compliance requirements.
  • Oversee the enforcement and periodic review of these policies to ensure they remain effective and up to date.
• Steering Committee and Governance Reporting
  • Provide regular updates on Information Security risks, compliance, and control effectiveness to the Risk and Crisis Committee, Information Security Board, and other relevant governance bodies.
  • Chair the Information Security Risk Committee and Information Security Working Group, ensuring the effective communication and management of security risks.

Risk Management

• Information Security Risk Management Framework
  • Develop, implement, and continuously improve the Information Security Risk Management Framework to ensure alignment with the Group's corporate risk management processes.
  • Identify, assess, and manage information security risks across the Group, incorporating findings from risk assessments, audits, and external testing.
  • Disseminate risk information appropriately across organizational levels.
• Supplier Assurance and Third-Party Risk Management
  • Ensure key 3rd-party suppliers are assessed against the ISO27001 control framework, with identified risks managed within the Group's risk appetite.
  • Maintain oversight of supplier assurance programs, ensuring continuous alignment with Group security standards and requirements.
• Threat Intelligence and Monitoring
  • Monitor the evolving threat landscape and integrate threat intelligence into the risk assessment process.
  • Use intelligence-led approaches to proactively mitigate risks and adjust security strategies accordingly.

Assurance and Audit

• Lead internal and external assurance, including certification and compliance audits.
• Conduct control gap analysis, ensure effectiveness reviews, and prioritize remediation actions with business owners.
• Act as a key liaison with auditors and certification bodies to maintain ISO27001 certification and other compliance requirements.

Collaboration and Stakeholder Engagement

• Partner with Technology teams to embed ISMS controls across the business and ensure compliance with security standards.
• Collaborate with internal and external stakeholders to enhance the Group's Information Security posture continually.

Education and Awareness

• Develop and manage a Group-wide Information Security Education and Awareness Program to foster a culture of security awareness and compliance among employees and technical teams.
• Track program effectiveness through metrics such as participation rates and phishing simulation results.

Advisory and Operational Excellence

• Provide subject matter expertise on the implementation and assurance of information security policies, standards, and controls in alignment with Group objectives.
• Offer day-to-day guidance for business and Technology teams on security-related change activities.

• Proven experience in a multi-national retail organisation.
• Proven track record of building and leading an Information Security GRC centre of excellence.
• Significant knowledge and 5+ years' experience of ISO27001, NIST CSF, Data Privacy Law, PCI DSS and ITIL.
• Awareness of regulatory requirements of the sector (e. g. UNC, GDPR; NIS Directive etc).
• A solid understanding of Information Security Governance, Risk and Compliance policies, controls and best practice.
• Previous experience developing, implementing and maintaining an Information Security Management System (ISMS), certification/re-certification to ISO27001.
• Subject Matter Expert in enterprise Risk Management - Information Security
• Experience in developing and embedding Risk Management Frameworks and associated processes and procedures.
• Proven people management and leadership skills including performance management and improvement, measurement of KRIs, situational leadership, issue resolution, negotiation and motivating others.

• Excellent senior leadership communication skills and demonstrable experience in a customer facing role.
• Ability to lead, manage and prioritise across multiple work streams simultaneously.
• Professional Certifications, including:
  • Certified Information Security Manager (CISM) or equivalent.
  • CISSP.
  • Certified ISO27001 implementer and or auditor.
  • Certified Information Security Auditor (CISA) is an advantage.

What We Can Offer You

With us,you will turn your aspirations into reality. We will help shape your journey through enriching exper.