To support the development, implementation, and continuous improvement of the organization's Cybersecurity Governance, Risk, and Compliance (GRC) framework. The role involves conducting cybersecurity risk assessments, developing and maintaining policies and procedures, monitoring compliance, and implementing security awareness initiatives to ensure the organization's IT, Information Systems (IS), and Operational Technology (OT) environments remain secure and compliant with applicable regulatory requirements and industry standards.
Key Responsibilities
- Develop, review, and maintain cybersecurity policies, procedures, and standards.
- Conduct cybersecurity risk assessments, compliance audits, and identify security gaps.
- Maintain cybersecurity risk registers and monitor mitigation actions.
- Perform third-party and vendor cybersecurity risk assessments.
- Ensure compliance with Saudi NCA and HCIS cybersecurity requirements.
- Support cybersecurity awareness programs, phishing simulations, and incident response activities.
- Monitor IT/OT security controls and prepare compliance reports and KPIs.
Mandatory Requirements
- Bachelor's degree in Cybersecurity, Information Security, Computer Science, or Information Technology.
- 5–6 years of experience in Cybersecurity GRC, IT GRC, or Information Security.
- Experience in Oil & Gas, Petrochemical, Power Generation, or related industrial projects.
- Strong knowledge of Saudi NCA and HCIS cybersecurity requirements.
- Hands-on experience in cybersecurity risk assessments, audits, policy development, and compliance management.
- Good understanding of IT and OT cybersecurity environments.
Preferred Certifications
CISA, CRISC, CISM, CISSP, ISO 27001 Lead Implementer/Lead Auditor, Security+, or CEH.