Chief Information Security Officer (CISO)

About the Job
The Chief Information Security Officer (CISO) is responsible for the overall cybersecurity posture of the organization and for ensuring compliance with applicable cybersecurity laws, regulations, and regulatory frameworks, including the National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC) within the Kingdom of Saudi Arabia (KSA).

The CISO will provide independent executive leadership and oversight across cybersecurity governance, risk management, and security operations. The role requires a pragmatic, business-oriented leader with strong expertise in cybersecurity, cloud security, and modern technology environments, capable of ensuring that cybersecurity risks are identified, managed, and reported in alignment with the organization's risk appetite and regulatory expectations.

You’ll collaborate closely with senior executives. This role offers the opportunity to shape strategic outcomes, reduce risk exposure, and drive secure innovation across complex, interconnected ecosystems.

Responsibilities
Cybersecurity Governance & Leadership:

• Establish and maintain enterprise-wide cybersecurity governance in line with SAMA CSF and NCA ECC requirements.
• Ensure clear ownership, accountability, and segregation of duties across cybersecurity functions.
• Advise executive management on cybersecurity risks, threats, and control effectiveness.
• Ensure cybersecurity considerations are embedded into corporate governance and enterprise risk management.

Cybersecurity Risk Management & Compliance:

• Own and oversee the cybersecurity risk management framework.
• Ensure continuous compliance with applicable regulations and industry good practices.
• Ensure timely remediation of audit findings and regulatory observations.
• Act as the primary point of accountability for cybersecurity matters with regulators.

Security Operations & Technology Oversight:

• Oversee cybersecurity operations including monitoring, detection, vulnerability management, IAM, and incident response.
• Ensure effective prevention, detection, response, and recovery capabilities.
• Govern the selection and operation of cybersecurity technologies.
• Ensure security by design across infrastructure, applications, cloud, and data platforms.

Incident Management & Cyber Resilience:

• Ensure effective incident response and cyber crisis management.
• Lead executive coordination during material cybersecurity incidents.
• Ensure alignment with business continuity and disaster recovery.
• Oversee post-incident reviews.

Third-Party & Outsourcing Cybersecurity:

• Ensure third-party cybersecurity risks are identified and managed.
• Ensure compliance of vendors with regulatory and contractual obligations.
• Oversee outsourced and managed security services.

People, Culture & Capability:

• Establish and maintain a compliant cybersecurity operating model.
• Develop national cybersecurity talent in alignment with Saudization.
• Promote cybersecurity awareness and culture.
• Ensure adequate resourcing and training.

Authority & Decision Rights:

• Define cybersecurity policies and standards.
• Escalate risks and incidents to executive management.
• Approve or reject cybersecurity risk acceptances.

Requirements
Minimum Qualifications:

• Education: A bachelor’s degree in computer science, computer engineering, information technology, or a related field.
• Experience: 5+ years of relevant experience in security strategy, cybersecurity governance, risk management, or related domains.
• Security Frameworks Knowledge: Familiarity with industry standards such as OWASP, SANS CWE Top 25, ISO 27001, PCI DSS, NIST, and SAMA/NCA frameworks.
• Proven executive leadership in cybersecurity governance, risk management, and regulatory compliance.
• Strong experience engaging with Boards, regulators, and senior executives on cybersecurity matters.
• Ability to translate complex cybersecurity risks into clear business and risk implications.
• Demonstrated leadership in building high-performing cybersecurity teams and national talent.

Preferred Qualifications:

• Sound decision-making and crisis leadership during material cybersecurity incidents.
• End-to-end security design and strategic roadmap of cloud security products and services.
• CISSP, CISM, CCSP, GIAC Certifications.

Location
Riyadh