Cyber GRC Lead: Policy, Risk & Compliance

Eram Talent; Jizan; On-site; SAR 180,000 - 240,000; Full time

Job summary

Eram Talent in Saudi Arabia seeks an experienced Cybersecurity GRC professional to support the development, implementation, and continuous improvement of the organization's GRC framework. You will conduct risk assessments, draft and maintain policies, monitor regulatory compliance, and lead awareness initiatives.

This role requires 5–6 years in Cybersecurity GRC or IT GRC, knowledge of Saudi NCA and HCIS, and hands-on experience across IT/OT environments, audits, and vendor risk assessments.

Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, or Information Technology.
• 5-6 years of experience in Cybersecurity GRC, IT GRC, or Information Security.
• Experience in Oil & Gas, Petrochemical, Power Generation, or related industrial projects.
• Strong knowledge of Saudi NCA and HCIS cybersecurity requirements.
• Hands-on experience in cybersecurity risk assessments, audits, policy development, and compliance management.
• Good understanding of IT and OT cybersecurity environments.

Responsibilities

• Develop, review, and maintain cybersecurity policies, procedures, and standards.
• Conduct cybersecurity risk assessments, compliance audits, and identify security gaps.
• Maintain cybersecurity risk registers and monitor mitigation actions.
• Perform third-party and vendor cybersecurity risk assessments.
• Ensure compliance with Saudi NCA and HCIS cybersecurity requirements.
• Support cybersecurity awareness programs, phishing simulations, and incident response activities.
• Monitor IT/OT security controls and prepare compliance reports and KPIs.

Skills

GRC expertise

Risk assessment

Audits

Policy development

Compliance management

IT/OT security

Education

Bachelor's degree in Cybersecurity/Information Security/CS/IT

Job description

Eram Talent in Saudi Arabia seeks an experienced Cybersecurity GRC professional to support the development, implementation, and continuous improvement of the organization's GRC framework. You will conduct risk assessments, draft and maintain policies, monitor regulatory compliance, and lead awareness initiatives.

This role requires 5–6 years in Cybersecurity GRC or IT GRC, knowledge of Saudi NCA and HCIS, and hands-on experience across IT/OT environments, audits, and vendor risk assessments.