Cybersecurity Governance, Risk & Compliance (GRC) Specialist

cloud consultancy - ccds; As Sudiyah; On-site; OMR 29,000 - 48,000; Full time

Job summary

cloud consultancy - ccds in Riyadh is seeking an experienced cybersecurity governance professional to support government entity's governance, risk and compliance, with 6+ years in the field and a focus on policy, risk registers, and executive reporting.

You will review policies, conduct risk assessments, manage evidence for audits, and coordinate remediation across teams using eGRC tools and ISO/IEC 27001 standards.

Qualifications

• Bachelor's degree in a related field required.
• 6+ years of experience in cybersecurity governance, risk and compliance.
• Advanced knowledge of Saudi and international cybersecurity frameworks (NCA controls, ISO/IEC 27001).
• Experience with risk registers, treatment plans, third‑party risk and executive reporting.

Responsibilities

• Review and update cybersecurity policies, procedures, standards and guidelines.
• Perform cybersecurity risk assessments across assets, systems, projects and third parties.
• Maintain the cybersecurity risk register, develop treatment plans, track actions and align with risk appetite.
• Conduct compliance gap assessments against NCA controls, ISO/IEC 27001 and other frameworks.
• Support internal and external audits, prepare evidence, manage non‑compliance and remediation.
• Operate or support eGRC and cybersecurity risk-management tools.
• Prepare management reports, dashboards, KPIs and committee presentations.

Skills

Cybersecurity governance

Risk management

Policy development

Executive reporting

Stakeholder management

Education

Bachelor's degree in Computer Science, Information Security, or related field

Tools

eGRC tools

Job description

Location: On-site - Riyadh, Saudi Arabia

Contract/engagement: Project-based managed cybersecurity services (13-month)

Minimum experience: 6+ years

Role Purpose

Support the governmental entity's cybersecurity governance, enterprise risk, regulatory compliance, audit readiness, and executive reporting activities.

Key Responsibilities

• Review and periodically update cybersecurity policies, procedures, standards, and guidelines
• Perform cybersecurity risk assessments covering assets, systems, projects, and third parties
• Maintain the cybersecurity risk register, develop treatment plans, track actions, and align decisions with the entity's approved risk appetite
• Conduct compliance gap assessments against NCA controls, ISO/IEC 27001, and other applicable national or international frameworks
• Support internal and external audits, prepare evidence, manage non-compliance cases, and follow remediation through closure
• Operate or support eGRC and cybersecurity risk-management tools
• Prepare management reports, executive dashboards, KPIs, compliance status reports, and committee-level presentations

Requirements

Technical and Professional Requirements

• Bachelor's degree in Computer Science, Information Security, or a related field
• At least 6 years of experience in cybersecurity governance, risk, and compliance
• Advanced knowledge of Saudi and international cybersecurity frameworks and standards, including NCA controls and ISO/IEC 27001
• Proven experience with cybersecurity risk registers, treatment plans, third-party risk, executive reporting, and eGRC tools

Personal Requirements

• Strong stakeholder-management skills and confidence working with senior leadership
• Excellent analytical, writing, presentation, and documentation skills
• Structured, detail-oriented, accountable, and able to coordinate remediation across multiple teams

Professional Certifications

Preferred: CISSP, CISM, CRISC, or ISO/IEC 27001 Lead Implementer (LI).