GRC Consultant

Help AG; Riyadh; On-site; SAR 120,000 - 180,000; Full time

Job summary

Help AG is seeking a GRC Consultant to support governance, risk, and compliance initiatives in the Saudi market. The role includes risk assessments, compliance reviews, policy development, and ISO 27001 implementation to meet regulatory requirements.

The candidate should have 1–4 years of experience in GRC or information security, with strong communication and documentation abilities to articulate risk findings clearly.

Qualifications

• Bachelor's degree in Cybersecurity, Information Security, CS, or related field.
• 1-4 years in GRC, information security, risk management, or IT audit.
• Knowledge of ISO 27001, NCA ECC, risk management, and compliance frameworks.
• Strong communication, documentation, and analytical skills.

Responsibilities

• Support governance, risk, and compliance initiatives.
• Conduct risk assessments and compliance reviews.
• Develop policies and implement ISO 27001.
• Work with cybersecurity frameworks and regulatory requirements (NCA ECC, SAMA CSF, PDPL).

Skills

Communication

Documentation

Analytical thinking

Risk management

IT audit

Education

Bachelor's degree in Cybersecurity/InfoSec/CS

Tools

ISO 27001

NCA ECC

SAMA CSF

PDPL

Job description

Seeking a GRC Consultant to support governance, risk, and compliance initiatives, including risk assessments, compliance reviews, policy development, and ISO 27001 implementation. The role involves working with cybersecurity frameworks and regulatory requirements such as NCA ECC, SAMA CSF, and PDPL.

Requirements

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, or related field.
• 1-4 years of experience in GRC, information security, risk management, or IT audit.
• Knowledge of ISO 27001, NCA ECC, risk management, and compliance frameworks.
• Strong communication, documentation, and analytical skills.

Preferred Certifications

• GRCP
• ISO 27001 Lead Implementer and/or Lead Auditor
• Additional certifications such as CISA, CRISC