Information Security Manager (KSA National)

Information Security Manager – Driving Robust Cybersecurity Governance in Riyadh

We are seeking a seasoned Information Security Manager to lead our cybersecurity governance framework in Riyadh, ensuring alignment with Saudi regulatory standards while safeguarding our organization’s digital assets. This pivotal role demands a strategic thinker with deep expertise in cybersecurity, risk management, and compliance—someone who can bridge the gap between technical security and executive leadership to fortify our security posture.

Key Responsibilities

As the Information Security Manager, you will play a critical role in shaping and enforcing our cybersecurity strategy, ensuring it remains resilient, compliant, and future-ready. Your responsibilities will include:

• Strategic Leadership: Develop and maintain a comprehensive cybersecurity strategy and roadmap, ensuring it evolves in tandem with emerging threats and regulatory expectations.
• Framework Governance: Lead the implementation and continuous improvement of our Information Security Management Framework (ISMF), ensuring full compliance with ISO/IEC 27001, NCA ECC, and all relevant Saudi regulatory requirements.
• Risk & Compliance Oversight: Own cybersecurity governance, policies, and standards, while managing the Cybersecurity Risk Register to proactively identify and mitigate vulnerabilities.
• Risk Assessments & Audits: Conduct thorough cybersecurity risk assessments across technology projects, cloud solutions, and third-party engagements, ensuring all initiatives adhere to security best practices.
• Compliance & Assurance: Oversee security compliance reviews, control assessments, and independent cybersecurity audits, tracking findings and remediation activities to address gaps systematically.
• Incident Response & Crisis Management: Provide independent oversight of cybersecurity incident governance and response protocols, ensuring swift and effective resolution during breaches or security incidents.
• Vendor & Third-Party Risk Management: Manage security risks associated with third-party vendors and external partners, ensuring contractual and operational alignment with security standards.
• Regulatory & Stakeholder Engagement: Serve as the primary liaison with Saudi regulators, auditors, and external assessors, while collaborating with Legal and other stakeholders to address Saudi PDPL (Personal Data Protection Law) and SDAIA (Saudi Data and Artificial Intelligence Authority) requirements.

What We’re Looking For

We are seeking a highly qualified professional with a proven track record in cybersecurity governance, risk management, and compliance. Ideal candidates will possess:

• 7–10 years of experience in information security, cybersecurity governance, or IT governance, with at least three years in a managerial or governance-focused role.
• Deep expertise in Saudi regulatory frameworks, including NCA ECC and Saudi cybersecurity compliance standards, with a strong understanding of PDPL and SDAIA requirements.
• Proven ISO/IEC 27001 experience, including leading certification audits and continuous improvement initiatives.
• Expertise in cybersecurity governance, risk, compliance, and assurance, with a focus on policy development, reporting, and stakeholder management at the executive level.
• A relevant bachelor’s degree in cybersecurity, information technology, or a related field, complemented by professional certifications such as CISM, CISA, ISO 27001 Lead Implementer/Auditor, or COBIT 2019.
• Fluent English and proficiency in Arabic (essential for effective communication in a Saudi business environment).

If you are a visionary leader with a passion for cybersecurity governance and a deep understanding of the Saudi regulatory landscape, we invite you to join our team in Riyadh and help shape the future of secure digital transformation.