IT GRC Specialist

About the role

The IT GRC Specialist will support IT governance, risk management, and compliance activities across the organization, ensuring adherence to Saudi regulatory requirements and enhancing cybersecurity and governance practices within a financial services environment.

Key responsibilities

• Support compliance initiatives related to NCA, CMA, PDPL and other applicable regulations.
• Assist in implementing and maintaining IT governance and cybersecurity frameworks such as ISO 27001.
• Develop, review and maintain IT policies, procedures, standards and controls.
• Maintain the IT risk register and track remediation activities.
• Conduct IT and cybersecurity risk assessments for vendors and third parties.
• Coordinate evidence collection and remediation for internal and external audits.
• Monitor compliance status and prepare governance and risk reports for management.
• Collaborate with IT, Security, Risk and Business teams to improve control effectiveness and regulatory readiness.

Required profile

• Bachelor's degree in Information Technology, Information Systems, Cybersecurity or a related field.
• 3–5 years of experience in IT Governance, Risk & Compliance, IT Audit or Information Security, preferably in the GCC region.
• Mandatory certifications: CRISC, CISA, ISO 27001 Lead Implementer/Auditor.
• Experience with regulatory frameworks such as NCA, ECC, ISO 27001, PDPL and financial‑sector compliance.
• Understanding of IT governance, risk management and compliance principles.
• Familiarity with IT controls including access management, change management, vulnerability management and disaster recovery.
• Strong documentation, reporting and audit coordination skills.
• Fluency in Arabic and English.

Required skills

• CRISC certification
• CISA certification
• ISO 27001 Lead Implementer/Auditor
• IT risk assessment
• Access management
• Change management
• Vulnerability management
• Disaster recovery