Business Analyst

Synechron; Riyadh; On-site; SAR 300,000 - 540,000; Full time

Job summary

Synechron is seeking an experienced GRC Risk and Compliance Analyst to support mapping, assessment, implementation, monitoring, and documentation of information-security controls against CIS Controls, NCA ECC, and ISO/IEC 27001.

The role collaborates with Information Security, Technology, Risk, Compliance, Internal Audit, and business stakeholders to ensure controls are designed, evidenced, and tracked through remediation.

Qualifications

• Minimum 5 years of GRC, information-security risk, IT risk, compliance, or cybersecurity governance experience.
• Practical experience with CIS Controls.
• Experience with NCA ECC or equivalent cybersecurity regulatory controls.
• Strong experience with ISO/IEC 27001 control mapping.
• Experience coordinating audits and evidence-collection workflows.
• Experience maintaining control matrices and compliance documentation.

Responsibilities

• Map organizational security controls against CIS Controls, NCA Essential Cybersecurity Controls and ISO/IEC 27001.
• Maintain control matrices, evidence registers, and compliance documentation.
• Coordinate audit and evidence-collection workflows with control owners.
• Assess evidence for completeness, relevance, validity, and coverage.
• Identify control gaps, exceptions, and remediation requirements.
• Track risks, findings, corrective actions through closure.

Skills

GRC experience

Information security risk

IT risk

Compliance governance

Cybersecurity governance

CIS Controls

NCA ECC

ISO/IEC 27001 mapping

Audit coordination

Evidence management

Documentation

Stakeholder management

Report writing

Tools

ServiceNow GRC

RSA Archer

MetricStream

OneTrust

LogicGate

AuditBoard

IBM OpenPages

Job description

We are looking for an experienced GRC Risk and Compliance Analyst with strong knowledge of information-security controls, compliance frameworks, audit preparation, and evidence-management processes.

The successful candidate will support the mapping, assessment, implementation, monitoring, and documentation of information-security controls against frameworks such as CIS Controls, NCA ECC, and ISO/IEC 27001.

The role will involve working with Information Security, Technology, Risk, Compliance, Internal Audit, external auditors, control owners, and business stakeholders to ensure that controls are properly designed, implemented, evidenced, and tracked through remediation.

Key Responsibilities:

• Map organizational security controls against:CIS Controls
• NCA Essential Cybersecurity Controls
• ISO/IEC 27001
• Other applicable regulatory or security frameworks
• Maintain control matrices, control libraries, evidence registers, and compliance documentation.
• Coordinate audit and compliance evidence-collection workflows.
• Work with control owners to obtain, validate, and organize audit evidence.
• Assess evidence for completeness, relevance, validity, and coverage.
• Identify control gaps, exceptions, and remediation requirements.
• Track risks, findings, corrective actions, and remediation activities through closure.
• Support internal audits, external audits, regulatory assessments, and compliance reviews.
• Prepare audit-readiness reports, compliance dashboards, status updates, and management presentations.
• Maintain audit trails and ensure evidence is stored in a structured and traceable manner.
• Support risk assessments and control-effectiveness reviews.
• Coordinate with Technology, Infrastructure, Cloud, Applications, IAM, SOC, Privacy, and Business teams.
• Review policies, standards, procedures, and control descriptions.
• Support the implementation and continuous improvement of GRC processes.
• Ensure control owners understand their responsibilities, evidence requirements, review frequency, and remediation timelines.
• Monitor changes in applicable regulatory and security requirements.

Required Skills:

• Minimum 5 years of GRC, information-security risk, IT risk, compliance, or cybersecurity governance experience.
• Practical experience with CIS Controls.
• Experience with NCA ECC or equivalent cybersecurity regulatory controls.
• Strong experience with ISO/IEC 27001 control mapping.
• Experience coordinating audits and evidence-collection workflows.
• Experience maintaining control matrices and compliance documentation.
• Knowledge of risk, control, audit, issue, and remediation-management processes.
• Strong documentation, analysis, coordination, and stakeholder-management skills.
• Ability to work with technical and non-technical control owners.
• Experience preparing reports and presentations for management or audit committees.

Preferred Skills:

• Experience with GRC platforms such as:ServiceNow GRC
• RSA Archer
• MetricStream
• OneTrust
• LogicGate
• AuditBoard
• IBM OpenPages
• ISO/IEC 27001 Lead Implementer or Lead Auditor certification.
• CISA, CRISC, CISSP, CISM, or equivalent.
• Experience with COBIT, NIST CSF, NIST 800-53, PCI DSS, or SOC 2.
• Experience in cloud security compliance.
• Experience with third-party risk management.
• Experience with business continuity, privacy, or operational resilience.
• UAE or Saudi regulatory-compliance experience.
• Experience automating evidence collection and compliance reporting.