Cybersecurity Governance, Risk & Compliance (GRC) Specialist

Location

• The role is on-site in Riyadh, Saudi Arabia.

Contract and Engagement

• The engagement is for project-based managed cybersecurity services lasting 13 months.

Minimum Experience

• The role requires a minimum of 6 years of experience.

Role Purpose

Key Responsibilities

• Review and periodically update cybersecurity policies, procedures, standards, and guidelines.
• Perform cybersecurity risk assessments covering assets, systems, projects, and third parties.
• Maintain the cybersecurity risk register, develop treatment plans, track actions, and align decisions with approved risk appetite.
• Conduct compliance gap assessments against NCA controls, ISO/IEC 27001, and other applicable frameworks.
• Support internal and external audits, prepare evidence, manage non-compliance cases, and follow remediation through closure.
• Operate or support eGRC and cybersecurity risk-management tools.
• Prepare management reports, executive dashboards, KPIs, compliance status reports, and committee-level presentations.

Technical and Professional Requirements

• Bachelor's degree in Computer Science, Information Security, or a related field.
• At least 6 years of experience in cybersecurity governance, risk, and compliance.
• Advanced knowledge of Saudi and international cybersecurity frameworks and standards, including NCA controls and ISO/IEC 27001.
• Proven experience with cybersecurity risk registers, treatment plans, third-party risk, executive reporting, and eGRC tools.

Personal Requirements

• Strong stakeholder-management skills and confidence working with senior leadership.
• Excellent analytical, writing, presentation, and documentation skills.
• Structured, detail-oriented, accountable, and able to coordinate remediation across multiple teams.

Professional Certifications

• CISSP, CISM, CRISC, or ISO/IEC 27001 Lead Implementer certification is preferred.