Business Analyst

Synechron; Saudi Arabia; On-site; SAR 150,000 - 230,000; Full time

Job summary

Synechron seeks an experienced GRC Risk and Compliance Analyst to map and assess security controls across CIS Controls, NCA ECC, and ISO/IEC 27001. You will coordinate audits, manage evidence, and work with control owners to ensure complete remediation and documentation.

The role collaborates with Information Security, Technology, Risk, Compliance, and Internal Audit to maintain accurate control matrices, evidence registers, and compliance dashboards, driving audit readiness and risk reporting

Qualifications

• Minimum 5 years of GRC, information-security risk, IT risk, compliance, or cybersecurity governance experience.
• Practical experience with CIS Controls.
• Experience with NCA ECC or equivalent cybersecurity regulatory controls.
• Strong experience with ISO/IEC 27001 control mapping.
• Experience coordinating audits and evidence-collection workflows.
• Experience maintaining control matrices and compliance documentation.
• Knowledge of risk, control, audit, issue, and remediation-management processes.
• Strong documentation, analysis, coordination, and stakeholder-management skills.
• Ability to work with technical and non-technical control owners.
• Experience preparing reports and presentations for management or audit committees.

Responsibilities

• Map organizational security controls against CIS Controls, NCA ECC, ISO/IEC 27001 and other frameworks.
• Maintain control matrices, control libraries, evidence registers, and compliance documentation.
• Coordinate audit and compliance evidence-collection workflows.
• Work with control owners to obtain, validate, and organize audit evidence.
• Assess evidence for completeness, relevance, validity, and coverage.
• Identify control gaps, exceptions, and remediation requirements.
• Track risks, findings, corrective actions, and remediation activities through closure.
• Support internal and external audits and regulatory assessments.
• Prepare audit-readiness reports, compliance dashboards, status updates, and management presentations.
• Maintain audit trails and structured evidence storage.
• Support risk assessments and control-effectiveness reviews.
• Coordinate with Technology, Infrastructure, Cloud, Applications, IAM, SOC, Privacy, and Business teams.
• Review policies, standards, procedures, and control descriptions.
• Support the implementation and continuous improvement of GRC processes.
• Ensure control owners understand responsibilities, evidence requirements, review frequency, and remediation timelines.
• Monitor changes in regulatory and security requirements.

Skills

GRC

information-security risk

CIS Controls

NCA ECC

ISO/IEC 27001

Audit coordination

Evidence management

Control mapping

Documentation

Stakeholder management

Tools

ServiceNow GRC

RSA Archer

MetricStream

OneTrust

LogicGate

AuditBoard

IBM OpenPages

Job description

We are looking for an experienced GRC Risk and Compliance Analyst with strong knowledge of information-security controls, compliance frameworks, audit preparation, and evidence-management processes.

The successful candidate will support the mapping, assessment, implementation, monitoring, and documentation of information-security controls against frameworks such as CIS Controls, NCA ECC, and ISO/IEC 27001.

The role will involve working with Information Security, Technology, Risk, Compliance, Internal Audit, external auditors, control owners, and business stakeholders to ensure that controls are properly designed, implemented, evidenced, and tracked through remediation.

Key Responsibilities:

• Map organizational security controls against:CIS Controls
• NCA Essential Cybersecurity Controls
• ISO/IEC 27001
• Other applicable regulatory or security frameworks
• Maintain control matrices, control libraries, evidence registers, and compliance documentation.
• Coordinate audit and compliance evidence-collection workflows.
• Work with control owners to obtain, validate, and organize audit evidence.
• Assess evidence for completeness, relevance, validity, and coverage.
• Identify control gaps, exceptions, and remediation requirements.
• Track risks, findings, corrective actions, and remediation activities through closure.
• Support internal audits, external audits, regulatory assessments, and compliance reviews.
• Prepare audit-readiness reports, compliance dashboards, status updates, and management presentations.
• Maintain audit trails and ensure evidence is stored in a structured and traceable manner.
• Support risk assessments and control-effectiveness reviews.
• Coordinate with Technology, Infrastructure, Cloud, Applications, IAM, SOC, Privacy, and Business teams.
• Review policies, standards, procedures, and control descriptions.
• Support the implementation and continuous improvement of GRC processes.
• Ensure control owners understand their responsibilities, evidence requirements, review frequency, and remediation timelines.
• Monitor changes in applicable regulatory and security requirements.

Required Skills:

• Minimum 5 years of GRC, information-security risk, IT risk, compliance, or cybersecurity governance experience.
• Practical experience with CIS Controls.
• Experience with NCA ECC or equivalent cybersecurity regulatory controls.
• Strong experience with ISO/IEC 27001 control mapping.
• Experience coordinating audits and evidence-collection workflows.
• Experience maintaining control matrices and compliance documentation.
• Knowledge of risk, control, audit, issue, and remediation-management processes.
• Strong documentation, analysis, coordination, and stakeholder-management skills.
• Ability to work with technical and non-technical control owners.
• Experience preparing reports and presentations for management or audit committees.

Preferred Skills:

• Experience with GRC platforms such as:ServiceNow GRC
• RSA Archer
• MetricStream
• OneTrust
• LogicGate
• AuditBoard
• IBM OpenPages
• ISO/IEC 27001 Lead Implementer or Lead Auditor certification.
• CISA, CRISC, CISSP, CISM, or equivalent.
• Experience with COBIT, NIST CSF, NIST 800-53, PCI DSS, or SOC 2.
• Experience in cloud security compliance.
• Experience with third-party risk management.
• Experience with business continuity, privacy, or operational resilience.
• UAE or Saudi regulatory-compliance experience.
• Experience automating evidence collection and compliance reporting.