Cybersecurity GRC Manager

About the Role
In this position, you will play a critical role in shaping and maintaining the organization's Information Security Governance framework while developing and executing a comprehensive Cyber Security Strategy aligned with business goals. Your expertise will ensure that cybersecurity risks are effectively managed, regulatory compliance is adhered to, and a strong security culture is fostered within the organization.

Responsibilities
Governance & Strategy:

• Develop, implement, and continuously improve the organization's Information Security Governance framework, policies, standards, and procedures.
• Lead the creation and execution of the Cyber Security Strategy in alignment with the company’s overall business goals.
• Provide regular reports to the Board of Directors and executive management on the state of cybersecurity.
• Establish and manage a security metrics and Key Performance Indicator (KPI) program to measure the effectiveness of the security program and report on progress.
• Oversee the information security budget, ensuring resources are allocated effectively to manage risk.

Risk Management:

• Design and manage a comprehensive enterprise-wide Cyber Security Risk Management program.
• Conduct regular risk assessments, including Business Impact Analysis (BIA), to identify, analyze, and evaluate information security risks.
• Facilitate risk treatment planning with business and technology owners, ensuring appropriate mitigation, acceptance, or transfer strategies are implemented.
• Manage the vendor risk management program, assessing the security posture of third-party vendors and partners, especially cloud service providers and payment gateways.
• Integrate risk management into the Software Development Life Cycle (SDLC) and change management processes.

Regulatory Compliance:

• Serve as the primary point of contact and subject matter expert for all regulatory examinations and audits related to cybersecurity (e.g., SAMA, CMA).
• Ensure continuous compliance with SAMA’s Cyber Security Framework (CSF), Payment Card Industry Data Security Standard (PCI DSS) requirements, and other relevant regulations.
• Manage the process for obtaining and maintaining necessary regulatory licenses and certifications from a cybersecurity perspective.
• Prepare and submit accurate and timely regulatory reports, questionnaires, and evidence requests.
• Monitor the regulatory landscape for changes in laws, regulations, and standards, and proactively advise the business on required adjustments.

Audit & Assurance:

• Manage all internal and external security audits, including coordinating with auditors, providing evidence, and tracking remediation of findings.
• Develop and maintain a robust control testing program to validate the effectiveness of key security controls.
• Manage the remediation of all audit and assessment findings, ensuring they are closed out effectively and permanently.

Awareness & Culture:

• Develop and deliver a security awareness and training program tailored to different roles within the organization, with a focus on local context and threats.
• Champion a strong security culture, ensuring that every employee understands their role in protecting the company’s information assets.

What We Offer You
We believe you will love working here!

• We have an inclusive and diverse culture that encourages innovation and flexibility in remote, in-office, and hybrid work setups.
• We offer highly competitive compensation packages, including the potential for shares.
• We prioritize personal development and provide regular training and an annual learning stipend to tackle new challenges and grow your career in a hyper-growth environment.
• Join a talented team of over 30 nationalities working in 7 countries and gain valuable experience in an exciting industry.
• We offer autonomy, mentoring, and challenging goals that create incredible opportunities for both you and the company.
• You will be given a lot of responsibility and trust. We believe that the best results come when the people responsible for a function are given the freedom to do what they think is best.