Cybersecurity GRC & Risk

ABOUT BDO – TECHNOLOGY & DIGITAL ADVISORY BDO's Technology & Digital Advisory practice delivers Cybersecurity & OT Security, IT Audit & Assurance, Data Privacy & Governance, Technology Risk (GRC), Business Resilience and Digital Transformation services across the Kingdom. POSITION LEVEL: ASSISTANT MANAGER / MANAGER ROLE OVERVIEW Join our team to help clients strengthen cybersecurity governance, risk management and regulatory compliance, and to lead cybersecurity programmes for leading organisations across the Kingdom. KEY RESPONSIBILITIES • Deliver cybersecurity governance, risk and compliance (GRC) engagements for clients across regulated sectors. • Assess client compliance against NCA frameworks (ECC, CSCC, CCC, DCC), SAMA CSF, ISO/IEC 27001 and NIST CSF, and develop practical remediation roadmaps. • Design and review cybersecurity policies, standards and procedures tailored to client environments. • Perform cybersecurity risk and maturity assessments, facilitate risk workshops and advise on risk treatment. • Design cybersecurity risk management methodologies and risk registers for clients. • Support clients through internal audits, external audits and regulatory reviews, including remediation tracking. • Perform third-party and vendor cybersecurity risk assessments. • Provide technical assurance and advisory over client cybersecurity programmes, including architecture and vendor deliverable reviews. • Design KPI/KRI frameworks and present findings and recommendations to client senior management. • Develop and deliver cybersecurity awareness programmes. • Contribute to proposals, methodologies and practice growth; coach and develop junior team members. REQUIREMENTS • Bachelor's degree in Cybersecurity, Information Security, IT, Information Systems, Risk Management or a related field. • Minimum 7+ years for Assistant Manager; 10+ years for Manager, including cybersecurity programme management. • Hands-on experience with NCA frameworks, SAMA CSF, ISO/IEC 27001, ISO/IEC 27005, NIST CSF/RMF and enterprise risk management. • Technical background across IAM/PAM, data security, cloud, SOC/SIEM and cyber resilience. • Preferred certifications: CISSP, CISM, CRISC, ISO/IEC 27001 Lead Implementer/Auditor, ISO/IEC 27005 Risk Manager; PMP or PRINCE2 is an advantage at Manager level. • Strong stakeholder management and executive reporting skills. • Excellent written and verbal communication in English; Arabic is an advantage.

Bachelor's degree in Cybersecurity, Information Security, IT, Information Systems, Risk Management or a related field. Minimum 7+ years for Assistant Manager; 10+ years for Manager, including cybersecurity programme management. Hands-on experience with NCA frameworks, SAMA CSF, ISO/IEC 27001, ISO/IEC 27005, NIST CSF/RMF and enterprise risk management. Technical background across IAM/PAM, data security, cloud, SOC/SIEM and cyber resilience. Preferred certifications: CISSP, CISM, CRISC, ISO/IEC 27001 Lead Implementer/Auditor, ISO/IEC 27005 Risk Manager; PMP or PRINCE2 is an advantage at Manager level. Strong stakeholder management and executive reporting skills. Excellent written and verbal communication in English; Arabic is an advantage.

Deliver cybersecurity governance, risk and compliance (GRC) engagements for clients across regulated sectors. Assess client compliance against NCA frameworks (ECC, CSCC, CCC, DCC), SAMA CSF, ISO/IEC 27001 and NIST CSF, and develop practical remediation roadmaps. Design and review cybersecurity policies, standards and procedures tailored to client environments. Perform cybersecurity risk and maturity assessments, facilitate risk workshops and advise on risk treatment. Design cybersecurity risk management methodologies and risk registers for clients. Support clients through internal audits, external audits and regulatory reviews, including remediation tracking. Perform third-party and vendor cybersecurity risk assessments. Provide technical assurance and advisory over client cybersecurity programmes, including architecture and vendor deliverable reviews. Design KPI/KRI frameworks and present findings and recommendations to client senior management. Develop and deliver cybersecurity awareness programmes. Contribute to proposals, methodologies and practice growth; coach and develop junior team members.