GRC Expert

COGNNA; Saudi Arabia; On-site; SAR 150,000 - 200,000; Full time

Job summary

A leading cybersecurity firm in Saudi Arabia seeks a GRC Expert with 4+ years of experience. The role involves managing compliance with local regulations, overseeing IAM governance, and conducting audits for ISO 27001 and SOC 2 certifications. Candidates should have a strong background in risk management and automated GRC platforms. This position offers a competitive salary and flexible, remote work options.

Benefits

Competitive salary

Equity options

Performance incentives

Flexible work environment

Qualifications

• Minimum 4 years of experience in GRC, Information Security, or IT Audit.
• Deep understanding of ISO 27001 and SOC 2 controls.
• Experience with automated GRC platforms.

Responsibilities

• Manage compliance with local Saudi regulations and certifications.
• Oversee the IAM lifecycle from a governance perspective.
• Conduct periodic risk assessments and maintain the Risk Register.

Skills

ISO 27001

SOC 2

Risk Assessment

IAM Governance

Communication Skills

Problem Solving

Education

Relevant Certifications (CISA, CISM, etc.)

Tools

Vanta

Okta

Azure AD

Google Workspace

Job description

We are seeking a GRC Expert with 4+ years of hands‑on experience to support the operation of our GRC department. This role requires a strong background in international certification frameworks (ISO 27001, SOC 2), comprehensive risk‑management experience, and specific expertise in identity and access management (IAM) governance.

Responsibilities

• Leverage our automated compliance platform (Vanta) to streamline evidence collection, manage audits, and ensure continuous compliance.
• Prepare and execute external audits for ISO 27001 and SOC 2 (Type 1 & 2) certifications.
• Manage compliance with local Saudi regulations, specifically NCA ECC and SAMA cybersecurity frameworks.
• Map internal controls to regulatory requirements (Custom Frameworks) and automate evidence collection.
• Monitor compliance posture daily, ensuring all automated tests in Vanta are passing and remediating gaps promptly.
• Oversee the IAM lifecycle from a governance perspective, ensuring “Least Privilege” and “Need‑to‑Know” principles.
• Execute Quarterly Access Reviews (User Access Reviews) campaigns within Vanta.
• Manage IdP integrations (Okta, Azure AD, Google Workspace) to ensure 100 % MFA adoption and timely offboarding of terminated users.
• Review and approve privileged access requests and ensure proper documentation of business needs.
• Maintain the organizational Risk Register and conduct periodic risk assessments.
• Perform Third‑Party Risk Management (TPRM) assessments for vendors.
• Review and update information‑security policies and procedures annually or as needed.
• Coordinate internal audits and pre‑assessments to ensure readiness for external certification bodies.
• Assist in responding to client security questionnaires and maintain the Vanta Trust Center.

Qualifications

• Minimum 4 years of dedicated experience in GRC, Information Security, or IT Audit.
• Deep understanding of ISO 27001 and SOC 2 controls.
• Familiarity with NCA ECC and SAMA regulations.
• Experience with automated GRC platforms.
• Solid understanding of IAM concepts (RBAC, SSO, MFA, PAM).
• Proficiency in risk‑assessment methodologies (ISO 27005, NIST SP 800‑30).
• Holding at least one relevant certification is preferred (e.g., CISA, CISM, CRISC, CISSP, ISO 27001 Lead Implementer/Auditor).
• Excellent communication skills in English (Arabic is a plus).
• Ability to work independently and manage multiple audit timelines simultaneously.
• Strong analytical and problem‑solving skills.

Benefits & Culture

Competitive package – salary, equity options, and performance incentives.
Flexible & remote – work from anywhere with an outcomes‑first culture.
Growth‑focused environment where your ideas ship, your voice counts, and your growth matters.
Global impact – build products that protect critical systems and data.