GRC Senior Specialist ( Saudi National Only)

About the Role
The GRC Senior Specialist provides governance, risk management, and compliance consultancy to the company. This role is responsible for owning the cybersecurity governance framework and ensuring compliance with the National Cybersecurity Authority (NCA) and other Saudi regulations.

Key Responsibilities

• Develop, review, and maintain cybersecurity policies, standards, and procedures.
• Lead compliance efforts with NCA Essential Cybersecurity Controls (ECC), Cybersecurity Controls Catalog (CCC), and other applicable frameworks like the Personal Data Protection Law (PDPL) and ISO 27001.
• Conduct gap assessments and build remediation roadmaps in collaboration with control owners.
• Manage the cybersecurity risk register: identify, assess, treat, and report on risks.
• Conduct third-party and vendor risk assessments.
• Prepare the organization for internal, external, and NCA audits, while managing evidence collection.
• Track compliance status and present risk and compliance reports to senior management.
• Support business continuity and disaster recovery planning, focusing on security aspects.
• Implement security awareness programs and communicate policies across the organization.
• Advise business and IT teams on regulatory and security requirements for new projects.

Requirements

• Bachelor's degree in Cybersecurity, Information Systems, IT, or a related field.
• Minimum of 7 years of experience in cybersecurity Governance, Risk, and Compliance (GRC), with at least 3 years in Saudi Arabia.
• Proven hands-on experience implementing NCA ECC and CCC, including conducting NCA self-assessments.
• Strong knowledge of ISO 27001, ISO 31000, NIST Cybersecurity Framework, and the Saudi PDPL.
• Experience in writing policies and leading audits from start to finish.
• Familiarity with GRC platforms such as ServiceNow IRM/GRC, RSA Archer, or MetricStream is a plus.
• Saudi national, fluent in Arabic and English, with strong report writing skills.

Preferred Certifications

• CISA (Certified Information Systems Auditor)
• CISM (Certified Information Security Manager)
• CRISC (Certified in Risk and Information Systems Control)
• CGEIT (Certified in the Governance of Enterprise IT)
• ISO 27001 Lead Implementer or Lead Auditor