IT Security Engineer

Overview

Security Governance & Compliance

• Ensure IT security practices comply with Saudi regulations.
• Implement and maintain internal security policies, procedures, and standards.
• Conduct security audits and compliance assessments for applications, infrastructure, and cloud services.
• Collaborate with management to ensure adherence to corporate governance requirements.

Threat & Vulnerability Management

• Monitor, detect, and respond to security threats across all IT systems.
• Conduct vulnerability assessments and penetration testing.
• Implement corrective measures and patch management to mitigate risks.
• Maintain security incident logs and coordinate with relevant teams for incident resolution.

Application & Infrastructure Security

• Secure all application and infrastructure layers, including web, backend, APIs, databases, and client applications.
• Review code, architecture, and deployment processes to identify security risks.
• Implement access control, authentication, encryption, and secure configurations.
• Collaborate with DevOps and Infra teams to ensure secure deployment pipelines.

Monitoring & Incident Response

• Set up monitoring, alerting, and logging for security events across applications and infrastructure.
• Lead incident response efforts and post-incident analysis.
• Develop disaster recovery and business continuity plans aligned with security requirements.

Knowledge Management & Training

• Develop security guidelines, SOPs, and documentation.
• Conduct training sessions and workshops to raise awareness among internal users and technical teams.
• Promote a security-conscious culture across the organization.

Collaboration & Technical Delivery

• Work closely with Infra, DevOps, and Development teams for secure architecture and operations.
• Review and approve security measures for new tools, applications, and integrations.
• Advise on security requirements for new projects, features, or customer integrations.

Job Relations

• Reports to: IT Infrastructure Lead / IT Manager
• Internal Relations: DevOps Engineer, Infra Engineer, QA, Development Teams, IT Support

External Communications

• Communicate with regulators and auditors to ensure compliance and provide reports.
• Liaise with external vendors for security assessments, penetration tests, and certifications.
• Escalate critical security risks to IT leadership and management.

Requirements

• Bachelor’s degree in computer engineering, Computer Science, or related field
• Certifications preferred: CISSP, CISM, CEH, ISO27001 Lead Implementer, or equivalent.
• 3+ years in IT security, preferably in enterprise or multi-location environments.
• Experience with security governance, risk management, and compliance.
• Hands-on experience with: Network and infrastructure security (firewalls, VPNs, IDS/IPS), Application security (web, backend, APIs, mobile), Security monitoring tools and SIEM, and Backup, DR, and disaster recovery planning
• Knowledge of Saudi regulations and compliance frameworks.

Competencies

• Strong analytical and problem-solving skills.
• Risk-aware mindset with attention to detail.
• Ability to translate regulatory requirements into operational security measures.
• Collaboration and influence across technical and non-technical teams.
• Proactive, process-oriented, and able to enforce security policies.

Skills & Languages

• Vulnerability management, penetration testing, and threat intelligence
• Security monitoring and SIEM tools
• Network security, firewalls, VPNs, encryption, IAM
• Application security best practices.
• Backup, disaster recovery, and business continuity planning
• Fluent in English (required).
• Arabic proficiency (preferred).