Chief Information Security Officer (CISO)

Role overview

Responsibilities

• Set cybersecurity strategy, policies, standards, governance, and business-project security requirements.
• Report risk, maturity, compliance, and KPIs to senior leaders, the Cybersecurity Committee, and Board.
• Lead the cybersecurity team and budget, employee development, and awareness programs.
• Manage cyber risk assessments, the risk register, mitigation, third-party and cloud risk, and technology-change reviews.
• Lead regulatory compliance, maturity assessments, audits, findings, corrective actions, and regulatory reporting coordination.
• Oversee monitoring, threat detection, vulnerability management, penetration testing, security operations, and incident response.
• Oversee network, application, endpoint, identity, and cloud controls; maintain independence from IT.

Required qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Computer Engineering, Information Systems, or related discipline.
• At least 8 years of cybersecurity or information security experience, including 3 years in leadership or supervision.
• Practical knowledge of SAMA CSF, cybersecurity governance, risk management, and regulatory compliance.
• Full-time CISO commitment without concurrent IT Department responsibilities.
• Meet professional suitability and integrity requirements and obtain required SAMA non-objection approval.
• Arabic: full professional written and spoken proficiency; English: advanced written and spoken proficiency.

Preferred qualifications

• Master's degree in Cybersecurity, Information Security, Business Administration, or related field.
• CISSP, CISM, CRISC, CGEIT, ISO/IEC 27001 Lead Auditor, or Lead Implementer certification.
• Regulated financial institution experience, Saudi Council of Engineers accreditation, or knowledge of PDPL and NCA controls.

Technical knowledge and competencies

• GRC platforms; SIEM and SOC; IAM and PAM; EDR/XDR and DLP.
• Vulnerability management, penetration testing, network, application, API, and cloud security.
• SAMA CSF, ISO/IEC 27001, and NIST Cybersecurity Framework.
• Strategic thinking, leadership, team development, decision-making, executive communication, and risk reporting.
• Crisis management, incident response, analytical problem-solving, vendor management, negotiation, and stakeholder engagement.
• Integrity, confidentiality, professional ethics, and collaboration with IT, Risk, Compliance, Legal, and Internal Audit.