GRC Consultant – Governance, Risk & Compliance (Saudi Arabia)

About the role

We are seeking a GRC Consultant to support the delivery of Governance, Risk and Compliance (GRC) services for clients in Saudi Arabia. The consultant will work closely with senior team members to conduct assessments, prepare audit documentation, and implement security frameworks that meet both international standards and local regulatory requirements.

Key responsibilities

• Assist in gathering and analysing data for GRC assessments.
• Prepare assessment reports, governance documentation, and client presentations.
• Lead preparation and execution of external audits for ISO 27001 and SOC 2 (Type 1 & 2) certifications.
• Manage compliance with Saudi regulations such as NCA ECC and SAMA cybersecurity frameworks.
• Conduct assessments against multiple frameworks (ISO 27001, NDI Controls, CSCC, DCC, TCC, OSMACC, etc.).
• Collaborate with senior consultants to develop and implement policies, procedures and controls.
• Participate in client workshops and project meetings.
• Liaise with cross‑functional teams (IT, legal, audit, operations) to support secure business operations.
• Assist in selecting and implementing GRC software solutions.
• Monitor industry trends, regulatory changes and emerging risks to provide proactive advice.
• Evaluate third‑party vendors for security and risk management compliance.
• Provide input to enterprise risk management from a cybersecurity perspective.
• Track and report key GRC metrics to stakeholders and executive leadership.

Required profile

• Bachelor’s degree in Cybersecurity, Information Technology or a related field.
• 5‑6 years of relevant experience in cybersecurity, internal audit, risk management or compliance.
• Professional certifications such as CISM, CISSP, CompTIA Security+, ISO 27001 Lead Implementer, SSCP or ITIL are a plus.
• Strong analytical, problem‑solving and communication skills.
• Detail‑oriented with a proactive, team‑oriented mindset.

Required skills

• Experience with GRC platforms and ITSM tools.
• Knowledge of ISO 27001, SOC 2, NCA ECC and SAMA cybersecurity frameworks.
• Risk assessment and audit execution capabilities.
• Policy and procedure development for compliance.
• Vendor compliance evaluation and cybersecurity risk management.