Information Security Specialist

Job description

We are seeking an Information Security Specialist (GRC) to join the employer The candidate will independently execute governance, risk, and compliance activities across the employer's information security program. Responsibilities include maintaining and updating the governance framework, policy library, standards and procedures; drafting and revising security policies, standards and baselines aligned with regulations; monitoring legal, regulatory and contractual changes (SAMA CSF, PDPL, NCA ECC, PCI‑DSS); managing RACI matrices and governance committee documentation; coordinating committee meetings; producing communication materials; conducting independent risk assessments and maintaining risk registers; updating the information asset register; leading business impact assessment data collection; evaluating control effectiveness; coordinating third‑party risk assessments; integrating risk data into procurement and project processes; preparing periodic risk reports; monitoring compliance with SAMA CSF, NCA ECC, PDPL, ISO 27001, PCI‑DSS; coordinating internal and external audits; supporting regulatory submissions; enhancing the security awareness program; tracking KPIs and KRIs; supporting integration of security requirements into procurement and change control; maintaining the policy, standard and procedure library; providing GRC expertise to business and technology teams; conducting information classification reviews; delivering awareness sessions; and providing analytical support for GRC reporting.

Requirements

• Proficient in maintaining and updating governance framework documentation
• proficient in drafting and revising information security policies, standards and baselines
• knowledgeable of regulatory requirements (SAMA CSF, PDPL, NCA ECC, PCI‑DSS)
• experienced in executing information security risk assessments and producing risk registers
• proficient in maintaining information asset register
• experienced in business impact assessment data collection
• knowledgeable of control effectiveness evaluation
• experienced in third‑party security risk assessments
• proficient in integrating risk data into procurement and project onboarding
• experienced in preparing periodic risk reports for senior review
• knowledgeable of compliance with ISO 27001 and PCI‑DSS
• proficient in coordinating internal and external audits
• knowledgeable of regulatory submission preparation
• proficient in developing security awareness programs
• knowledgeable of security program KPIs and KRIs
• proficient in maintaining policy, standard and procedure library
• proficient in supporting security initiatives across business and technology teams
• knowledgeable of information classification reviews
• proficient in delivering security awareness sessions
• proficient in analytical support for GRC reporting
• Bachelor's degree in IT, Computer Science, Software Engineering, Cybersecurity, Risk Management or related field
• 1–3 years of experience in information security governance, risk management or compliance
• hands‑on experience with risk assessment execution, policy development or compliance monitoring
• familiarity with SAMA CSF, ISO 27001, PDPL or NCA ECC requirements
• ISO 27001 Foundation or Lead Implementer (preferred)

Skills