Consultant – Senior Manager| Cyber Operate | Cybersecurity Compliance Specialist | KSA

Location
Riyadh

About the Role
As a Consultant – Senior Manager, you will have the opportunity to make a meaningful impact by working on compliance assessments and control testing in alignment with NCA ECC-2:2024 and other applicable controls. Your role will involve ensuring compliance with various standards, maintaining regulatory relationships, and supporting organizations in managing their compliance risks effectively.

Key Responsibilities

• Assess Compliance

  • Run compliance assessments against NCA ECC-2:2024 and other applicable NCA controls: CSCC (critical systems), CCC (cloud), DCC (data), OTCC (OT), TCC (telework), and OSMACC (social media accounts).
  • Assess compliance with ISO/IEC 27001:2022, PDPL data protection requirements, and other obligations that apply to the organization.
  • Evaluate new systems, projects, and major changes for compliance before go-live.
  • Conduct interviews with control owners, review relevant policies and procedures, and determine the implementation status of each control.

• Test Controls

  • Test control effectiveness through evidence sampling and technical checks, including user access reviews, privileged account listings, firewall rules, logging, and monitoring configurations.
  • Validate technical configurations against required baselines, utilizing automated compliance scans where available.
  • Identify and document weak or outdated evidence, and provide clear, defensible findings.

• Prepare for Regulators and Audits

  • Prepare NCA compliance self-assessments, evidence packs, and submissions, and support NCA assessments and other regulatory reviews.
  • Assist with ISO/IEC 27001 certification and surveillance audits, and internal audit reviews.
  • Coordinate responses to auditor requests and track audit findings to closure.

• Track and Report

  • Maintain the compliance obligations register and control-to-evidence mapping across NCA, ISO, and NIST.
  • Collaborate with control owners to agree on remediation plans, follow through to closure, and verify fixes.
  • Report compliance status, trends, and overdue actions to management and governance committees.
  • Monitor new and updated regulations (NCA, SDAIA/PDPL, NDMO) and assess their impact on the organization.

Leadership Capabilities

• Builds own understanding of purpose and values; explores opportunities for impact.
• Demonstrates strong commitment to personal learning and development; acts as a brand ambassador to help attract top talent.
• Understands expectations and holds personal accountability for keeping performance on track.
• Actively focuses on developing effective communication and relationship-building skills.
• Recognizes how daily work contributes to team and business priorities.

Qualifications

• 2-8 years of total experience.
• Bachelor's degree in cybersecurity, IT, or a related field.
• Hands-on experience with NCA ECC compliance assessments in Saudi Arabia (Mid and Senior levels).
• Demonstrated skills in control testing and evidence review, with sufficient technical understanding to assess access, network, logging, and configuration controls.
• Knowledge of ISO/IEC 27001 and NIST CSF 2.0.
• Strong proficiency in clear, precise written English.
• Experience with other NCA frameworks (CSCC, CCC, DCC, OTCC) preferred.
• Familiarity with supporting NCA assessments or ISO/IEC 27001 certification audits preferred.
• A working knowledge of PDPL and NDMO data management requirements preferred.
• Experience with a GRC platform (Archer, ServiceNow GRC, MetricStream, or similar) preferred.
• Proficiency in Arabic is preferred.
• Professional certifications such as CISA, ISO/IEC 27001 Lead Auditor, CISM are preferred; CRISC, CISSP, and CDPSE are also valued.

Frameworks & Standards

• NCA ECC-2:2024
• NCA CSCC / CCC / DCC / OTCC / TCC / OSMACC
• ISO/IEC 27001:2022
• NIST CSF 2.0
• PDPL
• NDMO Data Management Standards