Information Security GRC Specialist

About the role

The Information Security GRC Specialist will lead the implementation and continuous improvement of Mobily’s security risk management framework. You will work closely with business units, auditors and external partners to ensure the organization’s risk posture aligns with its strategic objectives and regulatory requirements.

Key responsibilities

• Implement and maintain the Security Risk Assessment methodology, policy and processes.
• Conduct hands‑on risk and gap assessments across applications, systems, data centres, infrastructure and third‑party vendors.
• Analyse vulnerability‑threat pairs, document findings and recommend effective controls.
• Update the risk register, communicate risks to stakeholders and drive remediation to an acceptable level.
• Monitor the company’s risk profile and appetite, balancing business opportunities with security considerations.
• Oversee the treatment of reported risks, review mitigation plans and escalate non‑mitigated issues.
• Coordinate and report on IS risk remediation activities and maintain up‑to‑date risk profiles for all information assets.
• Ensure ongoing compliance with Mobily’s policies, standards and ISO 27001:2013 ISMS, supporting annual recertification.
• Lead internal and external audit programmes, manage auditor expectations and maintain a knowledge repository for audit evidence.
• Promote security standards through training, governance documentation and periodic compliance reviews.

Required profile

• Proven experience in information security risk management, preferably within a large telecom or IT environment.
• Strong understanding of ISO 27001 and related compliance frameworks.
• Ability to communicate risk findings to senior business leaders and drive remediation actions.
• Experience coordinating third‑party risk assessments and audit activities.

Required skills

• ISO 27001 implementation and maintenance
• Risk assessment and vulnerability analysis
• Compliance auditing
• Security governance and policy management
• Information Security Management System (ISMS) knowledge