Strategic IT GRC & Compliance Specialist

Sahm Capital; Riyadh; On-site; SAR 140,000 - 230,000; Full time

Job summary

Sahm Capital is seeking an IT GRC Specialist to support governance, risk, and compliance across the organization. The role focuses on regulatory compliance for Saudi requirements and improving cybersecurity posture within a financial services context.

Responsibilities include supporting NCA, CMA, and PDPL initiatives, implementing ISO 27001 frameworks, maintaining policies, and coordinating audits and remediation with IT and risk teams. GCC region experience is a plus.

Qualifications

• Bachelor's degree in information technology, Information Systems, Cybersecurity or equivalent degree.
• 3–5 years of experience in IT GRC, IT Audit, Information Security or related role; GCC region is a plus.
• Certifications CRISC and CISA are must-have.
• Experience with regulatory frameworks such as NCA ECC, ISO 27001, PDPL or financial-sector compliance preferred.
• Experience in financial services, fintech, banking or capital markets is advantageous.

Responsibilities

• Support compliance initiatives related to NCA, CMA, PDPL and other regulatory requirements.
• Assist in implementing IT governance and cybersecurity frameworks such as ISO 27001.
• Develop, review and maintain IT policies, procedures, standards and controls.
• Maintain the IT risk register and track remediation activities.
• Conduct IT and cybersecurity risk assessments for vendors and third parties.
• Support audits by coordinating evidence collection and remediation activities.
• Monitor compliance status and prepare governance and risk reports for management.
• Collaborate with IT, Security, Risk and Business teams to improve control effectiveness.

Skills

GRC

IT governance

Risk assessment

Auditing

Documentation

Stakeholder management

Education

CRISC

CISA

Bachelor's degree in IT/IS/Cybersecurity

Job description

Sahm Capital is seeking an IT GRC Specialist to support governance, risk, and compliance across the organization. The role focuses on regulatory compliance for Saudi requirements and improving cybersecurity posture within a financial services context.

Responsibilities include supporting NCA, CMA, and PDPL initiatives, implementing ISO 27001 frameworks, maintaining policies, and coordinating audits and remediation with IT and risk teams. GCC region experience is a plus.