Governance Risk Compliance Specialist (GRC) Full Time NEW

We are seeking an experienced Governance Risk Compliance Specialist to join our client’s technology team in Riyadh. This role is fully on‑site and requires a strong background in secure‑by‑design principles, cloud security, and enterprise architecture governance.

Role Overview

Primary objective Establish and maintain cybersecurity governance and risk management frameworks for the client project, ensuring alignment with regulatory and industry standards.

Key responsibilities

• Maintain and update cybersecurity policies, standards and procedures for the client; ensure alignment with SAMA, NCA ECC, ISO 27001, NIST CSF, and applicable local regulations.
• Lead periodic cyber risk assessments across systems, projects and business processes.
• Maintain and manage the Cyber Risk Register: record risks, assign owners, document mitigation plans and track status.
• Coordinate risk treatment activities with business and IT owners, including risk acceptance and mitigation tracking.
• Produce governance reporting and dashboards, including KRIs, for management and risk committees.
• Ensure SOC operational activities map to governance requirements and control frameworks.
• Support regulatory self‑assessments, gap analyses and remediation planning.
• Manage exceptions and control deficiencies through formal governance processes.
• Provide stakeholder engagement, training, and awareness to ensure governance adoption.

Minimum experience and qualifications

• 7+ years in GRC / cyber risk roles, preferably within banking or financial services.
• Strong knowledge of ISO 27001, NIST CSF, and regional banking regulations (SAMA, NCA ECC).
• Proven experience conducting risk assessments and maintaining risk registers.
• Demonstrated experience in policy governance, control mapping, exception management, and governance reporting.
• Excellent stakeholder management and communication skills.

Certifications preferred

• CISA, CRISC, or ISO 27001 Lead Implementer/Lead Auditor (or equivalent).

Education

• Bachelor’s degree in Computer Science, Information Security, Risk Management, or related field.