GRC SME - Contract

We are seeking a highly experienced GRC Subject Matter Expert (SME) to support and lead Governance, Risk & Compliance initiatives for a leading organization in Al Khafji, Saudi Arabia. The ideal candidate will possess deep expertise in NCA Essential Cybersecurity Controls (ECC), Business Continuity Management (ISO 22301), Cybersecurity Governance, Risk Management, Compliance Assessments, and Audit Activities. The candidate must have proven experience acting as the primary SME, leading GRC programs from design through implementation while advising senior management and business stakeholders. Previous experience within the Oil & Gas sector is highly preferred. Key Responsibilities GRC Leadership & SME Responsibilities • Act as the organization's primary Subject Matter Expert (SME) for Governance, Risk & Compliance. • Lead and manage enterprise-wide GRC initiatives and strategic programs. • Provide expert guidance to senior management on cybersecurity governance, risk management, compliance, and business continuity matters. • Design, develop, and implement advanced GRC frameworks, methodologies, and operating models. • Serve as the lead advisor for GRC projects, assessments, audits, and compliance initiatives. • Mentor and support internal teams on GRC best practices. Governance & Risk Management • Develop cybersecurity governance frameworks, policies, standards, procedures, and guidelines. • Establish and maintain enterprise risk management programs. • Lead risk identification, assessment, treatment, mitigation, and monitoring activities. • Create and manage organizational risk registers. • Define and monitor Key Risk Indicators (KRIs). • Present risk findings and recommendations to leadership and stakeholders. Compliance & Regulatory Assessments • Lead compliance assessments against: • NCA Essential Cybersecurity Controls (ECC) • Saudi cybersecurity regulatory requirements • ISO 27001 • Other applicable cybersecurity frameworks • Conduct gap assessments and develop remediation plans. • Ensure ongoing compliance with regulatory and internal requirements. • Support external audits and regulatory inspections. Cybersecurity Audits & Maturity Assessments • Plan and execute cybersecurity audits and control reviews. • Conduct cybersecurity maturity assessments. • Evaluate control effectiveness and identify improvement opportunities. • Develop detailed assessment reports and executive presentations. • Track remediation actions until closure. Business Continuity Management (BCM) • Lead BCM initiatives aligned with ISO 22301. • Conduct Business Impact Analysis (BIA). • Develop, review, and maintain: • Business Continuity Plans (BCP) • Disaster Recovery Plans (DRP) • Crisis Management Procedures • Facilitate BCM testing, tabletop exercises, and awareness programs. • Ensure organizational readiness and resilience. Stakeholder & Client Management • Act as the primary point of contact for GRC engagements. • Build strong relationships with customers, regulators, management, and internal stakeholders. • Lead workshops, awareness sessions, and executive presentations. • Provide strategic recommendations on governance, risk, compliance, and cybersecurity improvements. Due Diligence & Strategic Advisory • Support mergers and acquisitions due diligence activities. • Evaluate cybersecurity, compliance, and risk exposure during acquisitions. • Provide recommendations to executive management regarding risk posture and mitigation strategies. Required Qualifications Bachelor's Degree in: Cybersecurity, Information Security, Information Technology, Computer Science or Related field Required Experience • Minimum 5-7+ years of experience in: • Governance, Risk & Compliance (GRC) • Cybersecurity Governance • Risk Management • Compliance Management • Business Continuity Management • Proven experience acting as a lead SME, consultant, or advisor. • Strong hands-on experience with NCA ECC. • Strong experience implementing or assessing ISO 22301 BCM programs. • Experience leading risk assessments and compliance reviews. • Experience managing enterprise risk registers. • Experience leading audits and maturity assessments. • Experience engaging directly with senior management and executive stakeholders. • Oil & Gas industry experience preferred. Required Certifications • CISSP • CISM • CISA • CRISC • GSEC • ISO 27001 Lead Implementer • ISO 27001 Lead Auditor • PCIP Additional BCM or Risk certifications are advantageous. Technical Skills • NCA Essential Cybersecurity Controls (ECC) • ISO 22301 • ISO 27001 • Governance Frameworks • Enterprise Risk Management • Risk Registers • Compliance Assessments • Cybersecurity Audits • BCM & Disaster Recovery • Third-Party Risk Management • Policy & Procedure Development • Cybersecurity Maturity Assessments • GRC Platforms & Tools