Cybersecurity Architect – Security Governance, Cloud & GRC | Riyadh, Saudi Arabia

VaporVM Ltd.; Saudi Arabia; On-site; SAR 94,000 - 156,000; Full time

Job summary

VaporVM Ltd. in Riyadh, Saudi Arabia, is seeking a seasoned Cybersecurity Architect to lead security strategy and governance on-site.

The role targets professionals with 8–12 years of experience across GRC, risk management, threat monitoring, incident response, and cloud security. You will work with ISO 27001:2022, SAMA-CSF, NCA, PDPL, CST CRF compliance, oversee penetration testing, vulnerability management, SIEM, and secure vendor risk assessments while enabling secure cloud, application, API

Qualifications

• 8–12 years of professional cybersecurity experience.
• Current residence in Saudi Arabia.
• Availability as an immediate joiner.
• Strong knowledge of ISO 27001:2022, SAMA-CSF, NCA, PDPL, CST CRF.
• Strong experience in Security Governance, GRC, and Risk Management.
• Experience with penetration testing and vulnerability management.
• Knowledge of SIEM, threat monitoring, and incident response.
• Experience with cloud, application, API, and IoT security.
• Strong understanding of OWASP Top 10, PTES, and MITRE ATT&CK.
• Experience in vendor security and third-party risk assessments.
• Strong analytical, communication, stakeholder-management, and problem-solving skills.

Responsibilities

• Develop and support cybersecurity architecture and security strategies.
• Apply relevant cybersecurity frameworks, standards, and regulatory requirements.
• Support compliance with ISO 27001:2022, SAMA-CSF, NCA, PDPL, and CST CRF requirements.
• Manage and support security governance, GRC, and enterprise risk-management activities.
• Assess security risks and recommend appropriate mitigation strategies.
• Support penetration testing and vulnerability management programs.
• Monitor security threats and support SIEM and incident-response activities.
• Apply security controls across cloud, applications, APIs, and IoT environments.
• Assess security risks throughout the technology and application lifecycle.
• Apply security testing and assessment methodologies aligned with OWASP Top 10, PTES, and MITRE ATT&CK.
• Conduct or support vendor security assessments and third-party risk reviews.
• Collaborate with technology, infrastructure, application, compliance, and business stakeholders.
• Support continuous improvement of cybersecurity controls, policies, and architecture.

Skills

Security Governance

GRC

Risk Management

Penetration Testing

Vulnerability Management

SIEM

Threat Monitoring

Incident Response

Cloud Security

Application Security

API Security

IoT Security

Tools

OWASP Top 10

PTES

MITRE ATT&CK

ISO 27001:2022

Job description

Location

Riyadh, Saudi Arabia — On-site

Job Category

• Information Technology (IT) & Software


• Security & Defence


• Legal & Compliance


• Banking & Insurance


• Telecommunications

Job Overview

VaporVM is seeking an experienced Cybersecurity Architect to join its team in Riyadh, Saudi Arabia. This on-site opportunity is suitable for cybersecurity professionals with 8–12 years of experience and strong expertise across security architecture, governance, risk and compliance, vulnerability management, threat monitoring, incident response, and cloud security.

The role requires comprehensive knowledge of cybersecurity frameworks and Saudi regulatory requirements, including ISO 27001:2022, SAMA-CSF, NCA, PDPL, and CST CRF. The successful candidate will work across security governance, penetration testing, vulnerability management, SIEM, cloud, application, API, and IoT security, as well as vendor and third-party risk assessments.

This position offers opportunities for career growth and professional development within cybersecurity architecture, GRC, security engineering, cloud security, and regulatory compliance. Relevant certifications and specialized cybersecurity training can further strengthen long-term career progression.

Key Responsibilities

• Develop and support cybersecurity architecture and security strategies.


• Apply relevant cybersecurity frameworks, standards, and regulatory requirements.


• Support compliance with ISO 27001:2022, SAMA-CSF, NCA, PDPL, and CST CRF requirements.


• Manage and support security governance, GRC, and enterprise risk-management activities.


• Assess security risks and recommend appropriate mitigation strategies.


• Support penetration testing and vulnerability management programs.


• Monitor security threats and support SIEM and incident-response activities.


• Apply security controls across cloud, applications, APIs, and IoT environments.


• Assess security risks throughout the technology and application lifecycle.


• Apply security testing and assessment methodologies aligned with OWASP Top 10, PTES, and MITRE ATT&CK.


• Conduct or support vendor security assessments and third-party risk reviews.


• Collaborate with technology, infrastructure, application, compliance, and business stakeholders.


• Support continuous improvement of cybersecurity controls, policies, and architecture.

Requirements & Qualifications

• 8–12 years of professional cybersecurity experience.


• Current residence in Saudi Arabia is required.


• Availability as an immediate joiner is required.


• Strong knowledge of:
  
  
  
  • ISO 27001:2022
  
  
  • SAMA Cyber Security Framework (SAMA-CSF)
  
  
  • National Cybersecurity Authority (NCA) requirements
  
  
  • Personal Data Protection Law (PDPL)
  
  
  • CST Cybersecurity Regulatory Framework (CST CRF)
  
  
  
  


• Strong experience in Security Governance, GRC, and Risk Management.


• Experience with penetration testing and vulnerability management.


• Knowledge of SIEM, threat monitoring, and incident response.


• Experience with cloud, application, API, and IoT security.


• Strong understanding of OWASP Top 10, PTES, and MITRE ATT&CK.


• Experience in vendor security and third-party risk assessments.


• Strong analytical, communication, stakeholder-management, and problem-solving skills.

Preferred Certifications

• CISM


• CISA


• ISO 27001 Lead Auditor


• ISO 27001 Lead Implementer


• CAP or equivalent cybersecurity certification

Salary, Benefits & Career Growth

Salary: Up to SAR 14,000 per month, based on the job posting.

The position provides opportunities for career growth and professional development across cybersecurity architecture, security governance, GRC, regulatory compliance, cloud security, vulnerability management, and threat response. Candidates can further strengthen their professional profile through certifications such as CISM, CISA, ISO 27001 Lead Auditor/Implementer, CAP, and other relevant cybersecurity credentials.

Joining: Immediate joiner required

Location Requirement: Candidates must currently be based in Saudi Arabia.