• Prepare, contribute and report to regional risk governance and board committee meetings, highlighting control status, risk exposure, and readiness
• Execute risk assessments and control testing across UAE operations in line with VARA cybersecurity guidelines and security best practices
• Maintain and review Business Impact Assessments (BIA), integrating findings into global resilience planning
• Contribute to Business Continuity Plan (BCP) documentation, testing, and updates, including entity-specific scenarios
• Collaborate with Group Security and IT to:
• Align UAE-specific regulatory controls with global policies and control frameworks
• Contribute to the development of security policies to meet international and UAE compliance requirements
• Conduct security control validation and document evidence for internal/external audits
• Participate in remediation planning for audit findings and track progress to closure
• Support the RISO in preparing and submitting regulatory documentation to regulators
• Prepare and present security and resilience reports for internal governance committees and local entity management
• Assist in responses to regulatory examinations, including due diligence and compliance queries
• Liaise with compliance and legal teams to interpret regulatory changes and propose control adaptations
• Participate in the regional incident response process, assist with post-incident reviews, and support continuous improvement activities
• Coordinate with cross-functional stakeholders to embed security requirements into operational processes

• Regulatory Governance
• Serve as the named ICT security officer for your appointed entities, with formal accountability for security risk, ICT governance, and resilience oversight at board level
• Prepare and present security, risk, and resilience materials to entity boards, with material review and coaching from the Global RISO Lead beforehand
• Act as the primary point of contact for VARA and other relevant regulatory authorities on ICT and security matters -- including examinations, inspections, licensing interactions, and ongoing supervisory dialogue
• Support entity go live processes by implementing and localizing established group ICT governance frameworks for new market launches, ensuring they meet UAE regulatory requirements and entity specific needs
• As the portfolio evolves, engage with additional regulatory frameworks with support from the broader RISO team
• ICT Risk and Security
• Lead ICT and security risk assessments for your appointed entity, escalating material risks through local governance and the Global RISO Lead
• Maintain and adapt entity level policies and procedures to align with group standards and UAE regulatory requirements
• Coordinate control testing, evidence documentation, and audit preparation with global security and compliance teams
• Manage the classification, escalation, and regulatory reporting of ICT-related incidents within the timeframes required by applicable regulators
• Operational Resilience
• Lead business impact assessments, critical function mapping, and business continuity planning at the entity level
• Oversee continuity and recovery testing, ensuring outputs meet regulatory expectations and feed back into global resilience planning
• Maintain oversight of ICT third-party dependencies and outsourcing arrangements in line with regulatory requirements
• Group Liaison
• Act as a key local liaison between UAE entities, the RISO team, Group Security, and Compliance
• Drive local implementation of group frameworks, policies, and resilience standards, adapting them where jurisdiction-specific requirements demand
• Represent entity priorities in group-led security initiatives and governance forums

What you bring

• 7+ years of experience in information security governance, ICT risk management, or regulatory compliance in a regulated financial services, fintech, or virtual asset environment
• Direct experience as a named regulatory contact, involvement in regulatory examinations, supervisory interactions, licensing processes, or equivalent
• Familiarity with UAE regulatory frameworks. Experience with VARA or other virtual asset / crypto-native regulatory regimes is a significant advantage and strongly preferred
• Demonstrated ability to implement, adapt, and maintain compliance or governance frameworks within a regulated environment
• Experience conducting risk assessments, business impact analyses, and resilience planning at the entity level
• Familiarity with ICT outsourcing and third-party risk management within group structures
• Ability to translate technical risk into board-level narrative and regulatory-grade documentation
• Comfortable operating across multiple jurisdictions simultaneously, each at a different stage of regulatory maturity
• Strong project management skills and the ability to drive outcomes across cross-functional, globally distributed teams
• Certifications such as CISSP, CISM, CRISC, CISA, or ISO27001 Lead Implementer preferred
• Familiarity with EU frameworks such as DORA and MiCA is strongly preferred

Why this role

• You will hold a named role within a regulated entity with accountability and board-level visibility
• You will operate at the frontier of virtual asset regulation -- VARA is one of the most advanced and fastest-evolving crypto regulatory frameworks in the world, and you will be shaping how Kraken meets it from day one of market entry
• You will build ICT governance programs from scratch for new market entries, not inherit and maintain what others have set up
• Exposure to local governance forums, regulators, and senior stakeholders, with remote guidance and preparation support from the Global RISO Lead
• The scope of this role is intentionally designed to grow -- as Kraken's entity footprint expands, so does the portfolio and the regulatory breadth you will be exposed to, potentially including Asian and EU frameworks such as DORA
• You will join a remote-first, international team shaping the future of crypto asset governance and resilience across some of the world's most demanding regulatory environments

Unless a specific application deadline is stated in the job posting, applications are accepted on an ongoing basis.

Please note, applicants are permitted to redact or remove information on their resume that identifies age, date of birth, or dates of attendance at or graduation from an educational institution.

Our commitment

Payward is powered by people from around the world and we celebrate the diverse talents, backgrounds, contributions, and unique perspectives that everyone brings to the table. We hire based on merit, seeking out people with the right abilities, knowledge, and skills for the job. We encourage you to apply for roles where you don't fully meet the listed requirements, especially if you're passionate or knowledgeable about crypto.

We may ask candidates to complete job-related skills or work-style assessments as part of our hiring process. These assessments evaluate competencies relevant to the role and are applied consistently across candidates for similar positions. Results are considered alongside experience and interviews, and are not the sole basis for any employment decision.

Stay connected

Follow us on Twitter

Learn on the Kraken Blog

Connect on LinkedIn