General Manager, Governance, Risk & Compliance

About the role

The General Manager, Governance, Risk & Compliance leads the organization’s second line of defense, designing and operating integrated GRC frameworks. Reporting to the CEO and interfacing with the Board Risk/Audit Committee, this role ensures compliance with Saudi regulations, corporate governance standards, and prepares the company for potential public listing.

Key responsibilities

• Develop and maintain the corporate governance manual, Delegation of Authority, Code of Conduct and committee charters in line with CMA and Companies Law.
• Establish an Enterprise Risk Management (ERM) framework aligned to ISO 31000/COSO, define risk appetite, maintain the risk register and key risk indicators, and report to senior management and the Board.
• Build and operate a comprehensive compliance program, monitor regulatory changes, conduct testing, and manage the whistle‑blowing channel.
• Design the internal control framework, lead control self‑assessments and coordinate remediation activities.
• Oversee the full policy lifecycle, maintaining a central repository of approved policies.
• Lead GRC workstreams for IPO readiness, ensuring post‑listing obligations are met.
• Ensure compliance with the Saudi Personal Data Protection Law (PDPL) and related data‑governance requirements.
• Promote a risk‑aware, ethical culture through training and awareness initiatives.
• Coordinate business continuity and crisis‑management frameworks.
• Produce consolidated GRC reporting and dashboards for executive and board committees.
• Lead, develop and retain the GRC team across governance, risk and compliance disciplines.

Required profile

• Extensive senior‑level experience in governance, risk management, compliance or internal audit, preferably within a regulated industry.
• Proven track record of building and leading GRC functions and teams.
• Strong understanding of Saudi corporate governance regulations, CMA requirements and the Companies Law.
• Experience with IPO preparation or post‑listing compliance is highly desirable.
• Excellent communication skills with the ability to influence senior executives and board members.

Required skills

• Knowledge of ISO 31000 and COSO ERM frameworks.
• Familiarity with Saudi CMA corporate governance regulations and the Companies Law.
• Understanding of the Saudi Personal Data Protection Law (PDPL) and data‑governance obligations.
• Experience with GRC platforms and tools for risk, control and compliance data integration.