Cyber Security Specialist

About Flooss AL-AN Alkhaligia for Consumer Microfinance Company (Flooss) provides consumer microfinance solutions in Saudi Arabia and operates in the regulated financial sector under the supervision of the Saudi Central Bank (SAMA). We are building a customer-focused, technology-enabled, and well-governed organization, and we are looking for talented professionals who will help shape its next stage of growth. Role Purpose Support the Company's Cybersecurity function in protecting information assets, customer data, and digital services by implementing and monitoring security controls, responding to incidents, and supporting compliance with SAMA and other applicable regulatory requirements. The Cybersecurity Specialist will report to the Chief Information Security Officer (CISO) and work closely with the IT team, Risk, Compliance, and technology vendors. Key Responsibilities 1. Security Monitoring & Incident Response • Monitor security alerts and events from the SIEM, endpoint protection, and other security tools, whether in-house or through an outsourced Security Operations Center (SOC). • Investigate and triage security incidents, and support containment, eradication, and recovery activities. • Document incidents and support the preparation of incident reports to management and regulators as required. • Follow up on threat intelligence and assess its relevance to the Company's environment. 2. Vulnerability & Threat Management • Conduct regular vulnerability scans and track remediation with the IT team and vendors. • Coordinate penetration tests and follow up on closure of findings. • Review security configurations of servers, networks, cloud services, and endpoints against approved baselines. • Support security reviews of new systems, changes, and integrations before go-live. 3. Identity & Access Management • Review user access rights and privileged accounts periodically. • Monitor privileged access activity and report anomalies. • Support the implementation of access control policies, including multi-factor authentication and least-privilege principles. 4. Governance, Risk & Compliance • Support compliance with the SAMA Cyber Security Framework, NCA Essential Cybersecurity Controls, and the Personal Data Protection Law (PDPL). • Help maintain cybersecurity policies, standards, and procedures. • Support cybersecurity risk assessments and maturity self-assessments. • Prepare evidence for internal audits and regulatory examinations, and track remediation of findings. • Support cybersecurity assessments of third parties and vendors. 5. Awareness & Reporting • Support cybersecurity awareness programs, including phishing simulations and employee training. • Prepare periodic reports and key metrics on the Company's cybersecurity posture for the CISO. • Maintain accurate documentation of security tools, configurations, and procedures. Qualifications & Experience Education • Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field. Experience • Minimum 3 years of experience in cybersecurity or information security. • Experience in financial services, fintech, or consumer finance is preferred. • Experience working in a SAMA-regulated entity is an advantage. Professional Certifications • CompTIA Security+, CEH, or equivalent preferred. • CySA+, GIAC certifications (e.g., GSEC, GCIH), ISO 27001 Lead Implementer, or relevant cloud security certifications are an advantage. Technical Skills Good knowledge and practical experience in: • SIEM and security monitoring tools • Incident detection and response • Vulnerability scanning and management • Endpoint, network, and firewall security • Cloud security • Identity and access management (IAM/PAM) • Email and web security • Security configuration baselines and hardening Regulatory & Compliance Knowledge • Knowledge of the SAMA Cyber Security Framework. • Familiarity with NCA cybersecurity controls and the Personal Data Protection Law (PDPL). • Familiarity with international standards such as ISO 27001 and NIST. Personal Competencies • Strong analytical and investigative skills. • Ability to stay calm and act decisively during incidents. • Integrity and discretion in handling sensitive information. • Clear written and verbal communication. Languages • Fluent in Arabic and English. Nationality • Saudi national Show more Show less

Minimum 3 years of experience in cybersecurity or information security. Bachelor's degree in Cybersecurity, Computer Science, Information Technology, Engineering, or a related field. CompTIA Security+, CEH, or equivalent preferred. CySA+, GIAC certifications (e.g., GSEC, GCIH), ISO 27001 Lead Implementer, or relevant cloud security certifications are an advantage.

1) Security Monitoring & Incident Response: Monitor security alerts and events from SIEM, endpoint protection, and other tools; investigate and triage incidents; document incidents; prepare incident reports for management and regulators; follow up on threat intelligence. 2) Vulnerability & Threat Management: Conduct regular vulnerability scans; coordinate penetration tests; review security configurations; support security reviews before go-live. 3) Identity & Access Management: Review user access rights; monitor privileged activity; support access control policies including MFA and least-privilege. 4) Governance, Risk & Compliance: Support compliance with SAMA Cyber Security Framework, NCA Essential Cybersecurity Controls, and PDPL; maintain policies and procedures; assist risk assessments and maturity self-assessments; prepare evidence for audits; assess third parties. 5) Awareness & Reporting: Support awareness programs; prepare periodic security metrics; maintain documentation of tools and configurations.