Cybersecurity GRC Specialist

zamil offshore services company; Saudi Arabia; On-site; SAR 180,000 - 260,000; Full time

Job summary

Zamil Offshore Services Company is seeking an experienced cybersecurity governance, risk, and compliance professional to establish and oversee our GRC program. You will develop policies, drive awareness, and ensure regulatory alignment with ISO 27001, NCA ECC, and Saudi PDPL.

Responsibilities include risk management, vendor assessments, audit preparation, and maintaining evidence for audits, with collaboration across HR and departments to enforce security controls.

Qualifications

• Bachelor's degree in information security, IT Governance, Law, or Business with Security specialization.
• 3–5 years of experience in cybersecurity compliance, audit, or GRC.
• In-depth experience implementing and managing ISMS and compliance frameworks.

Responsibilities

• Develop and maintain cybersecurity policies, procedures, and control documentation.
• Drive cybersecurity awareness, phishing and training initiatives.
• Ensure policies are updated, communicated, and enforced across departments.
• Align governance documents with NCA ECC, ISO 27001, and legal obligations.
• Conduct risk assessments, maintain risk register, and define treatment plans.
• Ensure compliance with NCA ECC, ISO 27001, and Saudi PDPL requirements.
• Perform third-party/vendor risk assessments and due diligence reviews.
• Track remediation plans and prepare for audits.
• Maintain dashboards for compliance posture and control performance.
• Develop, distribute, and track employee security training and awareness programs.
• Conduct phishing simulations and evaluate response trends.
• Collaborate with HR on onboarding and offboarding security procedures.
• Maintain evidence repository for audits and compliance tracking.
• Map security controls to NCA ECC domains and ensure maturity documentation.

Skills

Policy development

Risk assessment

GRC frameworks

Security awareness

ISMS management

Education

Bachelor's in information security, IT governance, law or security-focused business

Job description

Job Purpose:

Establishing and overseeing the organization's cybersecurity governance, risk, and compliance framework to ensure alignment with regulatory requirements, industry standards, and business objectives

Key responsibilities:

• Develop and maintain cybersecurity policies, procedures, and control documentation
• Drive the organization's cybersecurity awareness, phishing and training initiatives
• Ensure policies are updated, communicated, and enforced across departments
• Align governance documents with NCA ECC, ISO 27001, and legal obligations
• Conduct risk assessments, maintain risk register, and define treatment plans
• Ensure compliance with NCA ECC, ISO 27001, and Saudi PDPL requirements
• Perform third-party/vendor risk assessments and due diligence reviews
• Track remediation plans and prepare for internal/external audits
• Maintain dashboards for compliance posture and control performance
• Develop, distribute, and track employee security training and awareness programs
• Conduct phishing simulations and evaluate response trends
• Collaborate with HR on onboarding and offboarding security procedures
• Maintain evidence repository for audits and compliance tracking
• Map security controls NCA ECC domains and ensures maturity documentation

Qualifications

• Bachelor's degree in information security, IT Governance, Law, or Business with Security specialization
• 3–5 years of experience in cybersecurity compliance, audit, or GRC
• In-depth experience in implementing and managing ISMS and compliance framework