Cybersecurity Risk Specialist / Consultant- KSA

Role Overview We are looking for an experienced Cybersecurity Risk Specialist / Consultant to support cybersecurity risk management within a banking environment. The role will be responsible for identifying, assessing, monitoring, and reporting cybersecurity risks while ensuring alignment with SAMA Cybersecurity Framework, NCA ECC, ISO 27001, and the bank’s internal policies and risk requirements. Key Responsibilities • Conduct cybersecurity and information security risk assessments across IT, applications, infrastructure, cloud, and business services. • Identify cybersecurity risks, vulnerabilities, control gaps, and potential business impacts, and recommend appropriate remediation actions. • Maintain and continuously update the Cybersecurity Risk Register, including risk ratings, owners, treatment plans, and remediation status. • Perform security control assessments against SAMA CSF, NCA ECC, ISO 27001, and internal security policies. • Support third-party/vendor cybersecurity risk assessments, including security due diligence and review of supplier controls. • Assess cybersecurity risks related to cloud services, new technologies, applications, projects, and major IT changes. • Work with Cybersecurity, IT, Risk, Compliance, Internal Audit, and business teams to address identified risks and control deficiencies. • Track remediation activities and provide regular risk dashboards and management reports to senior management and relevant committees. • Support regulatory and internal cybersecurity audits and assessments, including evidence collection and remediation tracking. • Review and assess security policies, standards, procedures, and control frameworks to ensure continued compliance. • Support cybersecurity risk acceptance, exception management, and compensating control processes. • Participate in security governance activities, risk committees, and cybersecurity awareness initiatives. • Provide cybersecurity risk advice to project teams and business stakeholders during solution design and implementation. Required Experience & Skills • 5+ years of experience in cybersecurity, information security, IT risk, GRC, or cybersecurity consulting. • Experience working within a banking or financial services environment is strongly preferred. • Strong practical knowledge of: • SAMA Cybersecurity Framework (CSF) • NCA Essential Cybersecurity Controls (ECC) • ISO 27001 / Information Security Management • Cybersecurity risk management and control frameworks • Third-party/vendor risk management • IT and cybersecurity audits • Experience performing cybersecurity risk and control assessments. • Good understanding of infrastructure, networks, cloud, applications, IAM, SOC, vulnerability management, and security operations. • Strong knowledge of risk assessment methodologies, risk treatment, risk acceptance, and control effectiveness. • Ability to translate technical cybersecurity risks into business and financial impact for management. • Strong documentation, analytical, presentation, and stakeholder-management skills. Preferred Certifications One or more of the following: • CISSP • CISA • CRISC • ISO 27001 Lead Implementer / Lead Auditor • CCSP • Relevant SAMA/NCA cybersecurity or risk certifications Education Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, Risk Management, or a related discipline. Show more Show less

5+ years of experience in cybersecurity, information security, IT risk, GRC, or cybersecurity consulting. Experience working within a banking or financial services environment is strongly preferred. Strong practical knowledge of: SAMA Cybersecurity Framework (CSF), NCA Essential Cybersecurity Controls (ECC), ISO 27001 / Information Security Management, Cybersecurity risk management and control frameworks, Third-party/vendor risk management, IT and cybersecurity audits, Experience performing cybersecurity risk and control assessments. Good understanding of infrastructure, networks, cloud, applications, IAM, SOC, vulnerability management, and security operations. Strong knowledge of risk assessment methodologies, risk treatment, risk acceptance, and control effectiveness. Ability to translate technical cybersecurity risks into business and financial impact for management. Strong documentation, analytical, presentation, and stakeholder-management skills.

Conduct cybersecurity and information security risk assessments across IT, applications, infrastructure, cloud, and business services. Identify cybersecurity risks, vulnerabilities, control gaps, and potential business impacts, and recommend appropriate remediation actions. Maintain and continuously update the Cybersecurity Risk Register, including risk ratings, owners, treatment plans, and remediation status. Perform security control assessments against SAMA CSF, NCA ECC, ISO 27001, and internal security policies. Support third-party/vendor cybersecurity risk assessments, including security due diligence and review of supplier controls. Assess cybersecurity risks related to cloud services, new technologies, applications, projects, and major IT changes. Work with Cybersecurity, IT, Risk, Compliance, Internal Audit, and business teams to address identified risks and control deficiencies. Track remediation activities and provide regular risk dashboards and management reports to senior management and relevant committees. Support regulatory and internal cybersecurity audits and assessments, including evidence collection and remediation tracking. Review and assess security policies, standards, procedures, and control frameworks to ensure continued compliance. Support cybersecurity risk acceptance, exception management, and compensating control processes. Participate in security governance activities, risk committees, and cybersecurity awareness initiatives. Provide cybersecurity risk advice to project teams and business stakeholders during solution design and implementation.