Cybersecurity GRC Specialist

About the role

The Cybersecurity GRC Specialist will lead the design, implementation and ongoing management of the organisation's governance, risk and compliance framework for information security. This role ensures that policies, controls and processes align with regulatory requirements, industry standards and business objectives.

Key responsibilities

• Develop, maintain and communicate cybersecurity policies, procedures and control documentation.
• Drive security awareness, phishing simulations and training programmes across the organisation.
• Align governance artefacts with NCA ECC, ISO 27001 and relevant legal obligations.
• Conduct risk assessments, maintain a risk register and define treatment plans.
• Ensure compliance with NCA ECC, ISO 27001 and Saudi PDPL requirements.
• Perform third‑party and vendor risk assessments and due‑diligence reviews.
• Track remediation actions and prepare for internal and external audits.
• Maintain dashboards that report compliance posture and control performance.
• Collaborate with HR on secure onboarding and off‑boarding processes.
• Maintain an evidence repository for audit and compliance tracking.

Required profile

• Bachelor’s degree in Information Security, IT Governance, Law or Business with a security focus.
• 3–5 years of experience in cybersecurity compliance, audit or GRC.
• Proven experience implementing and managing an ISMS and related compliance frameworks.

Required skills

• ISO 27001 implementation and maintenance.
• NCA ECC framework knowledge.
• Saudi PDPL compliance understanding.
• Risk assessment and treatment planning.
• Vendor/third‑party risk assessment.
• Audit preparation and evidence management.
• Security policy development and governance.