Information Security Compliance Consultant (Non-Technical)

Position Overview

We are seeking a highly motivated Information Security Compliance Consultant (Non-Technical) to join our team in Riyadh, Saudi Arabia. This role is pivotal in ensuring our organization adheres to information security and data protection regulations, with a strong focus on compliance, governance, regulatory coordination, and audit support. While this position is not technical in nature, it requires a deep understanding of regulatory frameworks and the ability to bridge communication between technical teams, senior leadership, and regulatory authorities. The successful candidate will serve as a key local representative, ensuring seamless alignment with Saudi regulatory requirements while maintaining robust compliance documentation and audit readiness.

Key Responsibilities

Government Liaison & Regulatory Compliance

As the primary local contact for regulatory authorities, including the National Cybersecurity Authority (NCA) and Saudi Data and Artificial Intelligence Authority (SDAIA), you will play a critical role in fostering strong relationships with government stakeholders. Your responsibilities will include:

• Monitoring, interpreting, and disseminating regulatory notices, requirements, circulars, and updates to internal stakeholders in a timely and accurate manner.
• Coordinating all regulatory communications, submissions, responses, and required documentation through official channels and portals to ensure compliance with local laws.
• Supporting the preparation and submission of regulatory notifications related to cybersecurity incidents or personal data breaches, in accordance with applicable legal and procedural requirements.
• Maintaining professional and effective communication with government and regulatory bodies to facilitate smooth interactions and compliance processes.

Personal Data Protection & PDPL Compliance

Your expertise will be instrumental in ensuring compliance with the Saudi Personal Data Protection Law (PDPL). You will collaborate closely with IT and business teams to:

• Coordinate the identification, documentation, and classification of personal data processing activities across the organization.
• Support the preparation and maintenance of PDPL-related filings, declarations, policies, procedures, and employee communications to ensure transparency and accountability.
• Own and maintain local PDPL compliance documentation, including audit trails and supporting evidence, to demonstrate adherence to regulatory standards.
• Ensure that all compliance documentation is accurate, up-to-date, well-organized, and readily accessible for regulatory reviews and audits.

Information Security Governance & Policy Localization

This role requires a keen understanding of global cybersecurity frameworks and the ability to localize them into Saudi-compliant policies, standard operating procedures (SOPs), and operational guidelines. Your responsibilities will include:

• Supporting the adaptation of global cybersecurity policies and frameworks to align with Saudi-specific requirements, including the NCA Essential Cybersecurity Controls (ECC) and Cloud Cybersecurity Controls (CCC).
• Collaborating with technical teams to gather and organize evidence required to demonstrate compliance with local and international standards.
• Maintaining rigorous version control and documentation standards across all policies, procedures, and compliance records to ensure consistency and traceability.

Audit Readiness & Compliance Evidence

A core aspect of this role is ensuring the organization is always prepared for regulatory audits and assessments. You will be responsible for:

• Developing and maintaining a structured Compliance Evidence Repository to ensure seamless audit traceability and readiness.
• Collecting, organizing, and maintaining comprehensive compliance evidence, including policy approvals, security committee meeting minutes, access approval records, training logs, system screenshots, and other supporting documentation.
• Coordinating with internal stakeholders and auditors to ensure all evidence is complete, accurate, and readily available when required.
• Tracking outstanding compliance requirements and ensuring timely follow-up and resolution to mitigate risks.

Training & Third-Party Compliance

To foster a culture of security awareness and compliance, you will:

• Coordinate and deliver information security and PDPL awareness training programs for local employees, ensuring widespread understanding and adherence to policies.
• Support the implementation of phishing simulation exercises and maintain detailed records of participation and outcomes.
• Assist with basic information security compliance checks for local vendors and third parties, including reviewing supporting documentation such as NDAs and information security clauses.

Qualifications & Experience

We are looking for a candidate with a minimum of 2 years of experience in compliance, IT governance, regulatory affairs, audit support, or information security-related roles. The ideal candidate will possess:

• A strong understanding of Saudi regulatory frameworks, including the PDPL, NCA Essential Cybersecurity Controls (ECC), and Cloud Cybersecurity Controls (CCC).
• Excellent communication and interpersonal skills, with the ability to liaise effectively with government authorities, senior leadership, and cross-functional teams.
• Strong analytical and organizational skills, with a meticulous attention to detail to ensure compliance documentation is accurate and up-to-date.
• The ability to interpret complex regulatory requirements and translate them into actionable policies and procedures.
• Proficiency in maintaining compliance documentation, audit trails, and evidence repositories to support regulatory reviews.
• A proactive approach to identifying compliance gaps and implementing corrective actions to mitigate risks.

This role offers a unique opportunity to contribute to the organization’s compliance and governance framework while playing a pivotal role in shaping its approach to information security and data protection in Saudi Arabia. If you are a detail-oriented professional with a passion for regulatory compliance and a commitment to excellence, we encourage you to apply.