Cybersecurity GRC Specialist

About the Role

Key Responsibilities

• Own and lead the organization's Cybersecurity GRC program end to end.
• Develop, maintain, review, and secure executive approval for cybersecurity policies, standards, procedures, and governance frameworks.
• Own and continuously maintain the cybersecurity risk register.
• Lead periodic and event-driven cybersecurity risk assessments across technology, applications, vendors, and event operations.
• Coordinate cybersecurity compliance self-assessments, third-party audits, and regulator-led audits.
• Manage third-party and vendor cybersecurity risk assessments, including due diligence, remediation tracking, and ongoing monitoring.
• Own the organization's data protection compliance program in coordination with Legal and business stakeholders.
• Support and coordinate Data Processing Agreements (DPAs) and related security/data protection requirements with third parties.
• Develop and manage the organization's cybersecurity awareness and training program.
• Maintain the policy exception and risk acceptance process.
• Establish and report cybersecurity GRC and compliance KPIs to senior leadership.
• Support post-incident reviews from a regulatory, compliance, reporting, and disclosure-obligation perspective.

Requirements

• 3+ years of relevant experience in Cybersecurity GRC, Information Security GRC, Cybersecurity Risk, Compliance, or Information Security.
• Proven experience managing cybersecurity governance, risk, and compliance programs.
• Strong experience developing and managing cybersecurity policies, standards, procedures, and controls.
• Experience maintaining cybersecurity risk registers and conducting risk assessments.
• Experience with third-party/vendor cybersecurity risk management and security due diligence.
• Experience supporting or coordinating internal, external, third-party, or regulatory audits.
• Strong understanding of cybersecurity compliance frameworks, standards, and regulatory requirements.
• Experience managing policy exceptions, risk acceptance, and remediation tracking.
• Experience developing and delivering cybersecurity awareness and training programs.
• Strong documentation, reporting, communication, and stakeholder management skills.

Preferred Qualifications

• Experience with data protection/privacy compliance and third-party data processing arrangements would be an advantage.
• Experience working in a large-scale, multi-vendor, or major event environment would be an advantage.
• Knowledge of Saudi cybersecurity and data protection requirements would be an advantage.

Preferred Certifications

• CISSP
• CISM
• CRISC
• CISA
• ISO 27001 Lead Implementer / Lead Auditor
• CGRC
• CDPSE
• CIPM / CIPP
• Other recognized cybersecurity GRC, risk, audit, or privacy certifications

Contract Details

• Location: Riyadh / Jeddah, Saudi Arabia.
• Contract duration: ASAP to 28-Feb-27.