Cybersecurity GRC Manager

2P Perfect Presentation; Saudi Arabia; On-site; SAR 60,000 - 100,000; Full time

Job summary

Join a forward-thinking company as a Cybersecurity GRC Manager in Riyadh, where you will lead the development and implementation of a robust information security governance, risk management, and compliance program. This role is crucial in ensuring that cybersecurity policies align with business objectives and regulatory requirements. You will proactively identify and mitigate risks while promoting security awareness across the organization. With a focus on continuous improvement, you will manage audits, compliance documentation, and training initiatives, making a significant impact on the company's security posture and resilience against emerging threats.

Qualifications

• 5+ years of experience in Cybersecurity, GRC, or IT compliance.
• Professional certifications such as CISSP, CISM, CRISC, CISA preferred.

Responsibilities

• Develop and maintain cybersecurity policies, standards, and procedures.
• Lead the identification, assessment, and prioritization of information security risks.
• Ensure compliance with all applicable laws, regulations, and industry standards.

Skills

Cybersecurity Governance

Risk Management

Compliance Management

Security Awareness Training

Business Continuity Planning

Education

Bachelor's degree in Cybersecurity

Bachelor's degree in Information Security

Bachelor's degree in IT related field

Tools

Cybersecurity Frameworks (SAMA, NCA, ISO 27001)

Risk Assessment Tools

Job description

We are seeking a Cybersecurity GRC Manager to join our team in Riyadh, Saudi Arabia. In this role, you will lead the development and implementation of our information security governance, risk management, and compliance (GRC) program. You will ensure our cybersecurity policies and procedures meet business objectives and regulatory requirements, including frameworks while proactively identifying and mitigating cybersecurity risks.

Responsibilities:

Governance

• Develop and maintain cybersecurity policies, standards, and procedures.
• Promote security awareness and ensure adherence to security frameworks (e.g., SAMA, NCA, ISO 27001).
• Provide guidance to business units regarding information security best practices.

Risk Management

• Lead the identification, assessment, and prioritization of information security risks.
• Oversee the risk assessment process, including third-party/vendor risk management.
• Develop risk treatment plans and track remediation efforts.
• Report on key risk and compliance metrics to senior management and the board.

Compliance

• Ensure compliance with all applicable laws, regulations, and industry standards
• Interpret, implement, and maintain controls aligned with Cybersecurity Frameworks requirements, ensuring continuous readiness for regulatory reviews and audits.
• Manage internal and external audits, including evidence collection and remediation.
• Maintain up-to-date documentation for compliance requirements and certifications.

Framework Alignment

• Map organizational controls and processes to identifying gaps and overseeing remediation.
• Monitor updates and changes to cybersecurity frameworks requirements, and adjust organizational policies and controls as needed.
• Coordinate and submit periodic reports and self-assessments

Awareness and training

• Lead security awareness and training initiatives.
• Design, implement, and lead comprehensive security awareness and training programs for all employees and relevant third parties.
• Conduct regular training sessions, phishing simulations, and targeted workshops to address current and emerging threats.
• Evaluate the effectiveness of awareness programs through testing and feedback, and continuously improve content and delivery.

Business Continuity

• Collaborate with relevant stakeholders to develop, implement, and test business continuity and disaster recovery plans from a cybersecurity perspective.
• Ensure critical assets and data are protected and can be restored in the event of a disruption.
• Conduct regular reviews and exercises to validate business continuity plans and update them based on lessons learned and evolving threats.
• Provide guidance on integrating cybersecurity requirements into overall business continuity management.

Requirements:

• Bachelor's degree in Cybersecurity, Information Security, or an IT related field.
• 5+ years of experience in Cybersecurity, GRC, or IT compliance.
• Professional certifications such as CISSP, CISM, CRISC, CISA, or similar are preferred.
• Experience working with Cybersecurity frameworks (e.g., SAMA, NCA, ISO 27001).