Cybersecurity GRC Manager (SAMA Regulated)

About the role

The Cybersecurity GRC Manager will lead the day‑to‑day execution of the organisation’s governance, risk and compliance programme for a SAMA‑regulated financing company. Reporting to the Chief of Cybersecurity, you will oversee a team of GRC analysts, maintain the risk register and provide senior leadership with clear insight into the company’s risk and compliance posture.

Key responsibilities

• Ensure continuous compliance with the SAMA Cyber Security Framework (CSF) through self‑assessments and regulatory reporting.
• Develop, execute and improve cybersecurity governance policies, procedures and standards aligned with SAMA, industry best practices and business goals.
• Lead enterprise‑wide risk assessments, gap analyses and maintain the risk register, presenting findings and remediation plans to senior leadership.
• Oversee the monitoring and enhancement of the cybersecurity controls framework across the organisation.
• Collaborate with IT, legal, audit and business units to embed risk management into operational decisions.
• Mentor and manage a team of GRC analysts/officers, handling workload, performance and professional development.
• Manage cybersecurity awareness, training programmes and incident‑response governance, including regulatory notifications to SAMA.
• Maintain relationships with SAMA, external auditors and third‑party assessors, ensuring audit readiness and tracking remediation.
• Monitor regulatory and threat landscape, translating emerging requirements into actionable recommendations.
• Support evaluation and integration of GRC tooling, SIEM, vulnerability‑management solutions and related vendors.

Required profile

• Bachelor’s degree in Computer Science, IT, Cybersecurity or related field (Master’s a plus).
• 5‑8 years of cybersecurity GRC experience, preferably within a SAMA‑regulated entity, with at least 2 years in a leadership role.
• Professional certifications: CISSP, CISM or CISA (required); CRISC (optional).
• Deep knowledge of SAMA CSF, NCA ECC, NIST and ISO 27001 frameworks.

Required skills

• SIEM platforms
• Vulnerability‑management tools
• GRC platforms