Amin Siddiqi

In this story

1. Security as a discipline of anticipation
2. Early career: from a data centre night shift to Y2K
3. Banking and a national investment fund
4. A governance role behind the security controls
5. What he says about secure design
6. The regulatory frame in Saudi Arabia
7. The threats he worries about
8. An awareness campaign described by its organiser
9. Leading by listening
10. Learning through a challenge

Security as a discipline of anticipation

Amin Siddiqi works in cybersecurity governance, secure development and awareness. Insights Success featured him under the title "Innovating to Protect", and he shared the feature from his professional LinkedIn account.

Siddiqi describes a career that began with fascination for technology and the wish to understand how computer systems work and where they are vulnerable. His published credentials include Certified Information Security Manager and Certified Data Privacy Solutions Engineer, joining management of information-security programmes with a design-stage view of privacy.

Early career: from a data centre night shift to Y2K

A Who's Who of the Industries feature gives a fuller account of how he began. He says he first took a job as an IT administrator at a local bank because he had always been interested in computers, and worked night shifts at the data centre of a large national bank, where the bank's chief information officer noticed him. He studied information technology at Prince Sultan University, and on graduation the same chief information officer rehired him and set him a challenge: join the team working on the Y2K problem.

In an interview with Passion Vista, which he shared from the same professional account, Siddiqi gives a personal reason for starting work early. His father died while he was still in high school, and he wanted to earn for his family. The magazine says his mother encouraged further study, leading him to the IT programme at Prince Sultan University. His recollection of the CIO who noticed his work and later brought him back to the bank connects education with an existing professional relationship. He credits the Y2K assignment with helping shape the career that followed.

After that, according to the feature, he moved between departments whenever a project needed finishing, until he was hired into a newly established information security department at a time when the field was new and demand for experts was sudden. The more he learned, the more he liked the work, and he completed the certifications and built his knowledge around it. The feature describes him as having entered cybersecurity "when the word itself was unheard of" and as an authority in governance, risk and compliance, with particular experience in the foreign banking sector in Saudi Arabia.

Banking and a national investment fund

His public professional biography lists earlier senior roles: Senior Manager, Acting Chief Information Security Officer and Head of Information Security governance, risk and compliance at Banque Saudi Fransi, followed by Vice President and then Senior Vice President for cybersecurity governance, risk and compliance at the Public Investment Fund.

The Who's Who feature lists several awards: a master-level CISO award, a CISO award from Cyber Sentinels, an award for completing a tier-three data centre migration, and an award for implementing a core banking application, in addition to project-related recognitions. His LinkedIn shows him thanking the Global CIO Forum for inclusion in its World CIO 200 awards, and sharing his inclusion in a coffee-table book of industry leaders.

An organiser's account of the World CIO roadshow lists Amin Siddiqui of the Public Investment Fund as Vice President and Head of Information Security Governance and Risk in its Master award category. His public post thanking Global CIO Forum connects him with that recognition.

A governance role behind the security controls

A separate Cyber Sentinels interview identifies him as Amin M Siddiqui, Senior Vice President and Head of Cybersecurity Governance and Risk, with his government employer kept confidential. In that account, he describes responsibility for building, maintaining and executing a governance programme. The work includes a lifecycle process for the information-security department's policy documents and ensuring that technology and business-development groups follow the relevant policies and implementation guidelines. He places government regulation and industry practice alongside the organisation's own standards.

He also identifies security-risk measurement as part of his remit, including key performance and risk indicators, together with coaching the people responsible for those goals. Asked what is most critical to the role, he connects incident identification and reporting with threat monitoring, preventive measures, personnel development and continuous communication. Budgets, business priorities and keeping senior stakeholders informed appear in the same account. His description presents governance as work that has to be maintained across departments, rather than a policy document handed off once.

The interview's title, 'The Barriers in the Journey of Digital Transformation', reflects a particular concern he raises: inadequate resource planning and a shortage of IT people. He identifies competition for talent as an obstacle, and points to communication and analytical skills as necessary for sharing insights across the organisation. His expectations of consultants include understanding operating systems, networking and virtualisation as well as threat modelling, implementation, testing and vulnerability assessment.

What he says about secure design

In the Insights Success feature, Siddiqi gives two financial-development examples. For a secure financial application, he worked with business analysts and regulatory experts to define requirements around data encryption, access control and financial regulations. For a new online banking feature, he worked with product managers, developers and compliance officers, proposing multi-factor authentication and encrypted transmission. He says the measures met security requirements while improving the user experience. His stated aim is for security to act as a facilitator rather than a blocker.

The regulatory frame in Saudi Arabia

Amin's article mentions two Saudi authorities by name. He says he follows guidelines from the National Cybersecurity Authority (NCA) and the Saudi Central Bank (SAMA).

He tells the magazine he keeps up with threats, regulations and best practice through webinars, conferences and training, and through active participation in ISACA and (ISC)².

His account also names the sources he uses to inform that work: SANS Institute research, the publications Dark Reading and Threatpost, and threat-intelligence platforms including ThreatConnect and Recorded Future. These appear alongside his professional associations and regulatory guidance, showing the different kinds of information he says he follows, from practical threat reporting to formal requirements.

The article's one detailed achievement is a cybersecurity awareness initiative for a Middle Eastern bank. According to the magazine, it began with a thorough risk assessment to find vulnerabilities and areas for improvement. He then developed training modules covering phishing, password management and safe browsing. Regular phishing simulations tested employees' responses and helped improve them. Revised cybersecurity policies made expectations clear and accessible, and interactive workshops and question-and-answer sessions engaged employees and collected feedback.

The magazine reports that the initiative led to "significantly increased employee awareness and understanding of cybersecurity threats", a marked reduction in successful phishing attacks, and a stronger security posture in line with industry regulations.

The threats he worries about

In the same feature, he describes leading a team to improve incident-response capability, drawing on the different skills of its members. He identifies incident-response time, incident counts and patch-management effectiveness among the measures he follows, with reports combining technical detail and summaries for stakeholders.

An awareness campaign described by its organiser

A public post from Siddiqi's professional account provides a named example of awareness work at Events Investment Fund. He describes a campaign of workshops, training sessions and interactive activities covering phishing, device security, sensitive information and social engineering. The closing activities included a cybersecurity quiz and virtual-reality challenges, with giveaways acknowledging participation. His account credits the team for its engagement and describes continued vigilance after the campaign, rather than treating the closing event as the end of security work.

Leading by listening

In his career interviews, Siddiqi identifies listening as a strength. He says he involves team members in decisions so that they feel heard, valued and appreciated. Passion Vista connects that approach with his interest in leaders such as Bill Gates, Jack Welch, Azim Premji and Warren Buffett: he admired their ability to influence people rather than simply manage a company.

The Passion Vista interview also records a principle he attributes to his father: balance, illustrated by holding a stick in the middle rather than at either end. He applies that idea to work and family life, saying that a difficult day in one should not determine how he behaves in the other. The account presents his wish to lead people, rather than merely manage them, alongside this personal measure of success: achievement should leave room for happiness.

Learning through a challenge

Another awareness-event account from Siddiqi describes a different set of activities: interactive robots, cybersecurity escape rooms, games and demonstrations with a white hacker. The escape rooms asked participants to think as both attackers and defenders. Rather than describing awareness only as a presentation or a set of instructions, his post records an event built around participation and hands-on learning.

He credits the participants and cybersecurity champions for their enthusiasm and teamwork. His explanation links creativity with education, presenting the event as part of the continuing effort to build a security culture. The account adds a practical example to his interest in listening and engagement: people were invited to work through challenges, not simply receive warnings.