GRC Consultant – Governance, Risk & Compliance

About the role

We are looking for a motivated GRC Consultant to help organisations strengthen their governance, risk and compliance (GRC) practices. Based in Riyadh, you will work with clients to align security controls with international standards and Saudi regulatory requirements, supporting a dynamic, client‑focused environment.

Key responsibilities

• Conduct GRC assessments, compliance reviews and gap analyses for client organisations.
• Support the design and implementation of security controls, policies and procedures.
• Perform risk assessments and develop remediation recommendations.
• Prepare compliance reports, policies, standards and related documentation.
• Assist clients in achieving compliance with local (e.g., NCA ECC, SAMA, PDPL, CST) and international standards.

Required profile

• Minimum 2 years of experience in GRC, information security, cybersecurity or related compliance roles.
• Fluent in Arabic and English, both spoken and written.
• Good understanding of ISO 27001 and Information Security Management Systems.
• Familiarity with global cybersecurity frameworks and standards.
• Strong communication, documentation and stakeholder‑management abilities.
• Preferred experience with Saudi regulations such as NCA ECC, SAMA Cybersecurity Framework, PDPL and CST, and relevant certifications.

Required skills

• ISO 27001
• Information Security Management System (ISMS)
• NCA ECC framework
• SAMA Cybersecurity Framework
• Personal Data Protection Law (PDPL)
• CST requirements
• Risk assessment
• Compliance assessment
• Audit processes