Cybersecurity Specialist (GRC & Operations)

About the role

WePay is building Saudi Arabia’s first escrow platform for secure digital transactions. As a Cybersecurity Specialist you will design, implement and monitor the security framework that protects our systems, data and customers while ensuring compliance with SAMA and NCA regulations.

Key responsibilities

• Develop and maintain a cybersecurity program aligned with SAMA CSF and NCA ECC/CCC requirements.
• Serve as the primary contact for GRC matters with external partners and regulators.
• Support SAMA inquiries, close observation gaps and prepare regulatory submissions.
• Review and improve security policies, procedures and controls.
• Monitor systems, applications and networks for threats, conduct vulnerability assessments and coordinate penetration testing.
• Perform risk assessments, track findings and drive corrective actions.
• Investigate security incidents, document findings and implement remediation.
• Manage access controls, privileged access and multi‑factor authentication.
• Produce security reports, audit evidence and regulatory documentation.
• Promote security awareness across internal teams.

Required profile

• Saudi national (as required by SAMA).
• 3‑5 years of cybersecurity experience in fintech, payments, banking or a regulated financial institution.
• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, IT or a related field.
• Strong knowledge of SAMA CSF, NCA ECC and NCA CCC.
• Excellent analytical, communication and report‑writing skills in Arabic and English.
• High integrity, sound judgement and ability to work independently in a fast‑growing startup.

Required skills

• SIEM tools
• Endpoint security solutions
• Access management and privileged access management
• Network security
• Cloud security tools
• Vulnerability assessment and penetration testing
• Incident response
• Risk assessment
• Multi‑factor authentication

What we offer

• Opportunity to shape one of Saudi Arabia’s first escrow platforms.
• Hands‑on involvement from day one with real impact.
• Continuous learning through solving new security challenges.
• Collaborative startup environment.