Cybersecurity Specialist

Role overview

Governance, risk, and controls

• Develop and update Information Security Division guidelines and procedures to meet standards and compliance requirements.
• Apply the ISO 31000 risk assessment process in line with the corporate enterprise risk management methodology.
• Conduct regular technical and process risk assessments as part of self-assessment activities.
• Review IT and OT control effectiveness, mitigate identified risks and gaps, and strengthen incident prevention, response, and recovery.
• Research and recommend technology controls to prevent, detect, and respond to security compromises.
• Maintain and continually improve IT governance functions.

Audits and standards

• Schedule internal security audits and conduct random audits at vendor facilities.
• Maintain audit evidence and close findings for internal controls, enterprise risk management, ISO 27001, ISA 99 / IEC 62443, and corporate governance audits.
• Align IT and OT controls with NIST Cybersecurity Framework, NIST 800-82 and 800-53, SAMA, NCA, HCIS, ISO 27001, and SANS Top 20 practices.

Data, continuity, and IT/OT support

• Develop a data classification and privacy framework and assist departments with categorizing data and applying suitable technical controls.
• Establish an IT/OT governance body and advisory board to develop common guidelines and oversee integrated security through IT/OT convergence.
• Document disaster-scenario resources and recovery priorities, and assess disruption risks against business continuity objectives.
• Prepare and validate IT and OT continuity requirements, key risk areas, performance indicators, and improvement measures.
• Support industrial control systems, electrical automation systems, cybersecurity systems, networks, and their operation.

Awareness and ongoing duties

• Deliver information security awareness training and phishing simulation exercises at regular intervals.
• Design security awareness programs using email campaigns, online modules, assessments, classroom training, digital posters, and screen savers.
• Participate in cybersecurity research, keep current with security issues, and engage with the higher education cybersecurity community.
• Perform other job-related duties assigned by the direct supervisor.

Education, certification, and experience

• Bachelor’s degree in Computer Science, IT, Computer Engineering, or equivalent.
• Cybersecurity certification required.
• 15 years of relevant work experience.

Communication