Cybersecurity GRC Specialist

About the role

CCDS is looking for a Cybersecurity Governance, Risk & Compliance (GRC) Specialist to work on-site in Riyadh, Saudi Arabia. This is a project-based engagement delivering managed cybersecurity services for a governmental entity, lasting 13 months. The specialist supports cybersecurity governance, enterprise risk, regulatory compliance, audit readiness and executive reporting.

Key responsibilities

• Review and periodically update cybersecurity policies, procedures, standards and guidelines.
• Perform cybersecurity risk assessments covering assets, systems, projects and third parties.
• Maintain the cybersecurity risk register, develop treatment plans, track actions and align decisions with the entity's approved risk appetite.
• Conduct compliance gap assessments against NCA controls, ISO/IEC 27001 and other national or international frameworks.
• Support internal and external audits, prepare evidence, manage non-compliance cases and follow remediation through closure.
• Operate or support eGRC and cybersecurity risk-management tools.
• Prepare management reports, executive dashboards, KPIs, compliance status reports and committee-level presentations.

Required profile

• Bachelor's degree in Computer Science, Information Security or a related field.
• At least 6 years of experience in cybersecurity governance, risk and compliance.
• Advanced knowledge of Saudi and international cybersecurity frameworks and standards, including NCA controls and ISO/IEC 27001.
• Proven experience with risk registers, treatment plans, third-party risk, executive reporting and eGRC tools.
• Strong stakeholder-management skills and confidence working with senior leadership.
• Excellent analytical, writing, presentation and documentation skills; structured, detail-oriented and able to coordinate remediation across teams.

Required skills

• Cybersecurity risk assessment and risk register maintenance
• Compliance gap analysis against NCA controls and ISO/IEC 27001
• eGRC tools
• Preferred certifications: CISSP, CISM, CRISC or ISO/IEC 27001 Lead Implementer (LI)