Business Analyst

Role Overview

Key Responsibilities

• Map organizational security controls against CIS Controls, NCA Essential Cybersecurity Controls, ISO/IEC 27001, and other applicable regulatory or security frameworks.
• Maintain control matrices, control libraries, evidence registers, and compliance documentation.
• Coordinate audit and compliance evidence-collection workflows.
• Work with control owners to obtain, validate, and organize audit evidence.
• Assess evidence for completeness, relevance, validity, and coverage.
• Identify control gaps, exceptions, and remediation requirements.
• Track risks, findings, corrective actions, and remediation activities through closure.
• Support internal audits, external audits, regulatory assessments, and compliance reviews.
• Prepare audit-readiness reports, compliance dashboards, status updates, and management presentations.
• Maintain audit trails and ensure evidence is stored in a structured and traceable manner.
• Support risk assessments and control-effectiveness reviews.
• Coordinate with Technology, Infrastructure, Cloud, Applications, IAM, SOC, Privacy, and Business teams.

Required Skills

• Minimum 5 years of GRC, information-security risk, IT risk, compliance, or cybersecurity governance experience.
• Practical experience with CIS Controls.
• Experience with NCA ECC or equivalent cybersecurity regulatory controls.
• Strong experience with ISO/IEC 27001 control mapping.
• Experience coordinating audits and evidence-collection workflows.
• Experience maintaining control matrices and compliance documentation.
• Knowledge of risk, control, audit, issue, and remediation-management processes.
• Strong documentation, analysis, coordination, and stakeholder-management skills.
• Ability to work with technical and non-technical control owners.
• Experience preparing reports and presentations for management or audit committees.

Preferred Skills

• Experience with GRC platforms such as ServiceNow GRC, RSA Archer, MetricStream, OneTrust, LogicGate, AuditBoard, or IBM OpenPages.
• ISO/IEC 27001 Lead Implementer or Lead Auditor certification.
• CISA, CRISC, CISSP, CISM, or equivalent certification.
• Experience with COBIT, NIST CSF, NIST 800-53, PCI DSS, or SOC 2.
• Experience in cloud security compliance.
• Experience with third-party risk management.
• Experience with business continuity, privacy, or operational resilience.
• UAE or Saudi regulatory-compliance experience.
• Experience automating evidence collection and compliance reporting.