Information Security amp Risk Manager1 Job DetailsPosition Title Information Security amp Risk ManagerDepartment Technology Services ITReports To Information Security CTOEmployment Type PermanentLocation Maadi Degla OnsiteGrade As per organizational structureDirect Reports As per approved organizational structure2 Job PurposeThe Information Security amp Risk Manager is responsible for leading the organizations Information Security and Cyber Risk function The role will design implement and maintain the cybersecurity program manage enterprise information security risks ensure compliance with applicable Saudi regulatory and industry requirements and promote a strong securityaware culture across the organizationThe role provides strategic and operational leadership across Information Security Governance Risk amp Compliance GRC Security Operations Incident Response Data Protection and Security Awareness3 Key Accountabilities amp DeliverablesThe role will be accountable for the development implementation and continuous improvement ofInformation Security Strategy and Cybersecurity RoadmapInformation Security policies standards procedures and guidelinesInformation Security Management System ISMSEnterprise IT and Cybersecurity Risk RegisterInformation Security Risk Assessment ReportsRisk Treatment and Remediation PlansSecurity Compliance Reports including ISO 27001 and applicable regulatory requirementsCybersecurity Control Framework and Control Effectiveness ReportsVulnerability Assessment and Penetration Testing VAPT ReportsCybersecurity Incident Reports and Root Cause Analysis RCASecurity Monitoring and Threat DashboardsCybersecurity KPI and KRI DashboardsIdentity and Access Management IAM Policies Models and Access MatricesData Classification and Data Protection FrameworkInternal and External Audit Reports and Evidence RepositoryAudit Findings and Remediation TrackingBusiness Continuity and Disaster Recovery BCPDR Security AlignmentSecurity Awareness and Training Programs and ReportsRegulatory Assessments submissions and compliance evidence4 Key ResponsibilitiesA Information Security Strategy amp GovernanceDefine develop and execute the organizations Information Security Strategy and cybersecurity roadmapOwn and continuously improve the Information Security Management System ISMSDevelop and maintain information security policies standards procedures and guidelinesEstablish effective cybersecurity governance frameworks aligned with business objectivesProvide regular reporting on cybersecurity posture risk exposure compliance and security program performance to the CTO and executive leadershipEstablish and monitor security KPIs KRIs and performance metricsEnsure information security requirements are incorporated into technology initiatives projects and business processesB Information Security Risk ManagementLead regular information security and cybersecurity risk assessments across the organizationOwn and maintain the enterprise IT and cybersecurity risk registerIdentify assess prioritize and communicate information security risksDevelop and manage risk treatment plans and ensure remediation activities are tracked through to closureWork closely with business units IT and other stakeholders to establish appropriate risk mitigation strategiesTranslate technical cybersecurity risks into business impact and communicate them effectively to senior managementMonitor the organizations overall cyber risk profile and provide recommendations for risk reductionC Security Operations amp SOCOversee Security Operations Centre SOC activities including SOC Analysts and Security EngineersEnsure effective security monitoring threat detection investigation and response capabilitiesOversee SIEM operations and security monitoring platforms such as Microsoft Sentinel Splunk or equivalent technologiesEstablish and monitor security incident management processesReview security alerts incidents trends and threat intelligenceEnsure appropriate escalation and response mechanisms are in place for critical security eventsMonitor and improve the effectiveness of security controls and operational processesD Cybersecurity Incident ResponseLead the organizations cybersecurity incident response capabilityEnsure effective detection containment eradication recovery and postincident activitiesDevelop maintain and continuously improve the Cybersecurity Incident Response Plan CIRPConduct regular incident response exercises and simulationsLead investigations into significant security incidents and ensure Root Cause Analysis RCA is completedTrack corrective and preventive actions resulting from security incidentsEnsure lessons learned are incorporated into security controls and processesE Governance Risk amp ComplianceLead Information Security Governance Risk and Compliance GRC activitiesEnsure compliance with applicable regulatory and industry requirements includingNational Cybersecurity Authority NCA requirementsSaudi Personal Data Protection Law PDPL
Visit
Careersaas to find millions of new and unfilled roles, including thousands of remote and hybrid positions.
