GRC Senior Specialist ( Saudi National Only)

Müller`s Solutions; Riyadh; On-site; SAR 300,000 - 520,000; Full time

Job summary

Saudi Motorsport Company is seeking a GRC Senior Specialist to lead governance, risk management and compliance efforts. The role owns the cybersecurity governance framework and ensures ongoing compliance with NCA and other Saudi regulations.

You will develop, review and maintain cybersecurity policies, run gap assessments, and manage the cybersecurity risk register while coordinating audits and remediation with control owners. Strong Arabic and English reporting skills are required.

Qualifications

• 7+ years in cybersecurity GRC.
• At least 3 years in KSA.
• Proven hands-on experience implementing NCA ECC and CCC.

Responsibilities

• Develop, review and maintain cybersecurity policies, standards and procedures.
• Lead compliance with NCA ECC, CCC, and other frameworks (PDPL, ISO 27001).
• Run gap assessments and build remediation roadmaps with control owners.
• Own the cybersecurity risk register: identify, assess, treat and report risks.
• Conduct third-party and vendor risk assessments.
• Prepare SMC for audits and manage evidence collection.
• Track compliance status and present risk & compliance reports to senior management.
• Support business continuity and disaster recovery planning from a security angle.
• Run security awareness programs and policy communication across the organization.
• Advise business and IT teams on regulatory and security requirements for new projects.

Skills

Cybersecurity GRC

Policy writing

Audit leadership

Risk assessment

Vendor risk management

Education

Bachelor's degree in cybersecurity or related field

Tools

ServiceNow IRM/GRC

RSA Archer

MetricStream

Job description

Role Summary

The GRC Senior Specialist provides governance, risk management and compliance consultancy to Saudi Motorsport Company. The role owns the cybersecurity governance framework and keeps SMC compliant with NCA and other Saudi regulations.

Key Responsibilities

• Develop, review and maintain cybersecurity policies, standards and procedures
• Lead compliance with NCA ECC, CCC, and other applicable frameworks (PDPL, ISO 27001)
• Run gap assessments and build remediation roadmaps with control owners
• Own the cybersecurity risk register: identify, assess, treat and report risks
• Conduct third-party and vendor risk assessments
• Prepare SMC for internal, external and NCA audits, and manage evidence collection
• Track compliance status and present risk and compliance reports to senior management
• Support business continuity and disaster recovery planning from a security angle
• Run security awareness programs and policy communication across the organization
• Advise business and IT teams on regulatory and security requirements for new projects

Requirements

• Bachelor's degree in Cybersecurity, Information Systems, IT or related field
• 7+ years in cybersecurity GRC, with at least 3 years in KSA
• Proven hands‑on experience implementing NCA ECC and CCC, including NCA self‑assessments
• Strong knowledge of ISO 27001, ISO 31000, NIST CSF and the Saudi PDPL
• Experience writing policies and leading audits end to end
• Familiarity with GRC platforms (ServiceNow IRM/GRC, RSA Archer, MetricStream) is a plus
• Saudi national, fluent in Arabic and English, with strong report writing skills

Preferred Certifications

CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer or Lead Auditor