Technology Risk Associate

About the Role

Lesha Aviation Capital seeks a highly skilled Technology Risk Associate to bolster its cybersecurity risk management and assurance across its business units and technological platforms. This full-time, onsite opportunity based in Doha, Qatar offers the chance to contribute to Lesha's dynamic growth phase by addressing varied, day-to-day cybersecurity challenges.

Key Responsibilities

• Evaluate security infrastructure including applications, cloud services, networks, databases, and middleware.
• Review and ensure security integration in proposed technology architectures.
• Perform threat modelling and conduct risk assessments for new technologies and initiatives.
• Define security baselines and configuration standards.
• Advise on security strategies for enterprise architecture and technological transformation efforts.
• Assess and enhance security controls in cloud environments such as Microsoft Azure, Google Cloud Platform, and Oracle Cloud Infrastructure.
• Evaluate cloud security aspects including identity management, network security, container governance, data protection, logging, and monitoring.
• Conduct comprehensive security and risk evaluations of AI, generative AI, machine learning, and emerging technologies.
• Oversee application security assessments through all software development lifecycle stages, establishing secure SDLC and DevSecOps methodologies.
• Integrate security measures into CI/CD pipelines and supervise various application security testing activities like SAST, DAST, SCA, and penetration testing.
• Lead enterprise vulnerability management programs, managing penetration tests and overseeing remediation governance.
• Govern security operations and incident response processes, collaborating with SOC teams to enhance threat detection and incident handling.
• Act as deputy to the Information Security Officer, supporting cybersecurity governance, risk management, compliance, and assurance frameworks.
• Prepare, maintain, and present cybersecurity reports, metrics, and audit documentation to support governance and regulatory requirements.

Preferred Certifications

• Offensive Security Certified Professional (OSCP)
• Certified Ethical Hacker (CEH)
• Computer Hacking Forensic Investigator (CHFI)
• Certified Information Systems Security Professional (CISSP)
• Certified Information Security Manager (CISM)

Educational and Experience Requirements

• Bachelor’s or Master’s degree in Computer Science, Information Technology, or related fields.
• Over 10 years of professional experience in Cybersecurity, Technology Risk Assessment, and Assurance.
• Proven expertise in frameworks such as ISO 27001, NIST, NIA, QCSF, PCI DSS, GDPR, PDPL, or related regulations.

Technical and Professional Skills

• Enterprise Security Architecture
• Cybersecurity Risk Assessment
• Cloud Security Management
• AI and Emerging Technology Risk Evaluation
• Application Security and DevSecOps Practices
• Vulnerability Assessment and Penetration Testing
• Threat Modelling
• Security Operations and Incident Response
• SIEM and Security Monitoring
• Executive Communication and Stakeholder Engagement

Key Competencies

• Strong analytical mindset with risk-informed decision-making.
• Ability to communicate complex cybersecurity matters as business risks.
• Expertise in regulatory and compliance landscapes.
• Leadership abilities to drive cybersecurity programs across multiple functions.
• Exceptional communication skills for engaging with executives and stakeholders.
• Balance between governance protocols and pragmatic technology/business needs.
• Problem-solving and influencing capabilities.