Vendor Security Risk Lead — TPSRM & Strategy

Qiddiya | القدية; Riyadh; On-site; SAR 360,000 - 640,000; Full time

Job summary

Qiddiya invites a seasoned leader to own and advance the Third-Party Security Risk Management program, ensuring vendors, partners, consultants and service providers meet cybersecurity requirements and do not introduce unacceptable risks to Qiddiya's information assets, systems, and operations.

You will establish risk assessment frameworks, oversee vendor security reviews, drive remediation of identified gaps, and collaborate with Procurement, Legal, Compliance, Enterprise Risk and Technology to

Qualifications

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, or related field.
• 8-12 years of cybersecurity experience.
• Minimum 4 years in Third-Party Security, Vendor Risk Management, Cybersecurity Risk Management, or GRC.
• Experience within large enterprises, giga projects, banking, telecom, government, or critical infrastructure environments.
• Experience managing teams and stakeholder engagement at senior levels.

Responsibilities

• Develop and maintain the Third-Party Security Risk Management (TPSRM) framework.
• Conduct cybersecurity due diligence and risk assessments for vendors and suppliers.
• Review security requirements during procurement, RFP, and contract stages.
• Assess cloud providers, SaaS platforms, managed service providers, and strategic partners.
• Define vendor security controls aligned with NCA ECC, ISO 27001, NIST, and Qiddiya cybersecurity standards.
• Establish vendor risk classification and assessment methodologies.
• Monitor remediation plans and track closure of identified security gaps.
• Collaborate with Procurement, Legal, Compliance, Enterprise Risk, and Technology teams.
• Lead periodic reassessments of critical vendors.
• Report third-party cyber risks, trends, and KPIs to senior management.
• Manage external security audits, questionnaires, and assurance activities.
• Lead and develop the Third-Party Security team

Skills

Vendor risk management

Cybersecurity risk management

Team leadership

Stakeholder engagement

Risk assessment

Education

Bachelor's degree in Cybersecurity, Information Security, Computer Science, or related field

Tools

NCA ECC

ISO 27001

NIST

Job description

Qiddiya invites a seasoned leader to own and advance the Third-Party Security Risk Management program, ensuring vendors, partners, consultants and service providers meet cybersecurity requirements and do not introduce unacceptable risks to Qiddiya's information assets, systems, and operations.

You will establish risk assessment frameworks, oversee vendor security reviews, drive remediation of identified gaps, and collaborate with Procurement, Legal, Compliance, Enterprise Risk and Technology to