Senior Cyber GRC Lead: Policy, Risk & Compliance

Müller`s Solutions; Riyadh; On-site; SAR 300,000 - 520,000; Full time

Job summary

Saudi Motorsport Company is seeking a GRC Senior Specialist to lead governance, risk management and compliance efforts. The role owns the cybersecurity governance framework and ensures ongoing compliance with NCA and other Saudi regulations.

You will develop, review and maintain cybersecurity policies, run gap assessments, and manage the cybersecurity risk register while coordinating audits and remediation with control owners. Strong Arabic and English reporting skills are required.

Qualifications

• 7+ years in cybersecurity GRC.
• At least 3 years in KSA.
• Proven hands-on experience implementing NCA ECC and CCC.

Responsibilities

• Develop, review and maintain cybersecurity policies, standards and procedures.
• Lead compliance with NCA ECC, CCC, and other frameworks (PDPL, ISO 27001).
• Run gap assessments and build remediation roadmaps with control owners.
• Own the cybersecurity risk register: identify, assess, treat and report risks.
• Conduct third-party and vendor risk assessments.
• Prepare SMC for audits and manage evidence collection.
• Track compliance status and present risk & compliance reports to senior management.
• Support business continuity and disaster recovery planning from a security angle.
• Run security awareness programs and policy communication across the organization.
• Advise business and IT teams on regulatory and security requirements for new projects.

Skills

Cybersecurity GRC

Policy writing

Audit leadership

Risk assessment

Vendor risk management

Education

Bachelor's degree in cybersecurity or related field

Tools

ServiceNow IRM/GRC

RSA Archer

MetricStream

Job description

Saudi Motorsport Company is seeking a GRC Senior Specialist to lead governance, risk management and compliance efforts. The role owns the cybersecurity governance framework and ensures ongoing compliance with NCA and other Saudi regulations.

You will develop, review and maintain cybersecurity policies, run gap assessments, and manage the cybersecurity risk register while coordinating audits and remediation with control owners. Strong Arabic and English reporting skills are required.