Consultant – Manager| Cyber Operate | Cybersecurity Risk Specialist | KSA

Role overview

Define and assess cyber risk

• Design risk taxonomy, asset and impact criteria, likelihood scales, risk matrices, and scoring rules.
• Define risk appetite and tolerance with leadership, aligned with enterprise risk management and ISO 31000.
• Write risk policies, procedures, and templates for acceptance, exceptions, and escalation.
• Align the framework with NCA ECC, ISO/IEC 27005, and NIST SP 800-30.
• Assess enterprise risks and scenarios with business and technology leaders.
• Assess critical systems, projects, major changes, and adoption of cloud, AI, or IoT technologies.
• Integrate findings from vulnerability management, penetration testing, OT security, third-party risk, and threat intelligence.
• Run risk workshops and challenge vague or optimistic ratings.

Treat, monitor, and report risk

• Maintain the cyber risk register with owners, ratings, treatment plans, due dates, and status.
• Track treatments, reassess residual risk, and escalate overdue or increasing risks.
• Manage risk acceptances and exceptions, ensuring they are justified, approved at the appropriate level, and time-limited.
• Define key risk indicators and thresholds and monitor them with the Performance Management team.
• Prepare risk reports and heat maps for management and risk committees, explaining changes, impact, and decisions needed.
• At senior level, introduce FAIR quantitative analysis for top risks and configure risk workflows in a GRC platform.

Qualifications

• 4–8 years of total experience.
• Bachelor’s degree in cybersecurity, IT, risk management, or a related field.
• Experience designing or substantially improving a cyber or IT risk methodology, or conducting end-to-end risk assessments, depending on level.
• Strong understanding of cybersecurity threats and controls sufficient to assess technical risk credibly.
• Working knowledge of ISO/IEC 27005, NIST SP 800-30, ISO 31000, and NCA ECC.
• Clear written English for management and committee reporting.

Preferred qualifications

• GRC platform experience, FAIR quantitative risk analysis, and linking cyber risk to enterprise risk management are preferred.
• Experience in large-scale development, hospitality, financial services, or critical infrastructure is preferred.
• Arabic is preferred.
• At least one of CRISC, ISO/IEC 27005 Risk Manager, or CISM is preferred; Open FAIR, CISSP, and ISO 31000 Risk Manager are also valued.

Location

• Riyadh.