Chief Information Security Officer (CISO) – IT/OT Security Lead

About the role

The Chief Information Security Officer (CISO) will define and drive the enterprise‑wide cybersecurity vision, strategy and programme. Reporting directly to the Board and Executive Committee, the CISO safeguards both IT and OT environments and ensures alignment with Saudi Vision 2030 and National Cybersecurity Authority (NCA) regulations.

Key responsibilities

• Develop and implement a comprehensive cybersecurity strategy that supports operational goals and safety standards.
• Ensure full compliance with NCA Essential Cybersecurity Controls (ECC), Critical Systems Cybersecurity Controls (CSCC) and Digital Control Centre (DCC) requirements.
• Lead the protection of Industrial Control Systems, signalling systems (ERTMS/ETCS) and rolling‑stock data, bridging IT and engineering teams.
• Manage the Cyber Security Operations Centre (CSOC) and oversee 24/7 threat monitoring and incident response.
• Conduct regular vulnerability assessments, penetration testing and threat modelling for critical infrastructure.
• Guarantee compliance with the Saudi Personal Data Protection Law (PDPL) and supervise third‑party risk management for suppliers and vendors.

Required profile

• Minimum 10 years of experience in information security, with at least 4 years in a senior leadership role (CISO, Head of Security, etc.).
• Proven experience securing critical infrastructure and OT/ICS environments (SCADA, PLC).
• Deep knowledge of NCA frameworks (ECC, CSCC, DCC) and Saudi PDPL.
• Any two of the following certifications: CISSP, CISM, CISA, GICSP.
• Strong understanding of cloud platforms (Azure, AWS) and IoT security.
• Saudi nationals are strongly preferred to meet Vision 2030 and Nitaqat requirements.

Required skills

• NCA Essential Cybersecurity Controls (ECC) and Critical Systems Cybersecurity Controls (CSCC)
• Digital Control Centre (DCC) compliance
• Cloud security – Azure, AWS
• IoT security
• OT/ICS security – SCADA, PLC
• Vulnerability assessment and penetration testing
• Incident response and CSOC management
• Data privacy compliance (PDPL)
• Third‑party risk management