GRC Information Security Specialist - Risk & Compliance

Tabby | تابي; Riyadh; On-site; SAR 180,000 - 300,000; Full time

Benefits offered by this job

International team

Stock options

Relocation support

Devices provided

Growth in fintech

Job summary

Tabby is seeking an Information Security Specialist (GRC) to independently drive governance, risk, and compliance across the organization’s information security program. You will work within the InfoSec GRC department in KSA, supporting policy development, risk assessments, audits, and regulatory submissions.

The role requires a 1–3 year background in information security governance and a strong familiarity with SAMA CSF, ISO 27001, PDPL, or NCA ECC.

Qualifications

• Bachelor's degree in IT, CS, Software Engineering, Cybersecurity, Risk Management or related field.
• 1–3 years of professional experience in information security governance, risk management, compliance or related fields.
• Hands‑on risk assessment execution, policy development or compliance monitoring required.
• Exposure to SAMA CSF, ISO 27001, PDPL, or NCA ECC is a strong advantage.
• Fintech or banking sector experience preferred.

Responsibilities

• Governance: maintain policy library, standards, procedures, and governance docs.
• Risk management: conduct risk assessments, maintain risk registers and BIAs.
• Compliance: monitor SAMA CSF, NCA ECC, PDPL, ISO 27001, PCI-DSS and coordinate audits.
• Programme development: support security awareness and KPI/KRI dashboards.
• Cross-functional: provide GRC SME support across projects and changes.
• Communicate security governance updates to stakeholders.

Skills

GRC knowledge

Policy development

Risk assessment

Audit coordination

Education

Bachelor's degree in Information Technology/CS/Cybersecurity/Risk Management

ISO 27001 Foundation/Lead Implementer (preferred)

Tools

CRISC

CISM

CompTIA Security+

ISO 27001

Job description

Tabby is seeking an Information Security Specialist (GRC) to independently drive governance, risk, and compliance across the organization’s information security program. You will work within the InfoSec GRC department in KSA, supporting policy development, risk assessments, audits, and regulatory submissions.

The role requires a 1–3 year background in information security governance and a strong familiarity with SAMA CSF, ISO 27001, PDPL, or NCA ECC.