Information Security Specialist

📣 إعلان

منذ يوم واحد

	نوع العقد	دوام كامل
	طبيعة الوظيفة	بالموقع
	الموقع	الرياض

وصف الوظيفة

About the Role

Tabby | تابي is seeking an Information Security Specialist (GRC) to join their team in Riyadh, Saudi Arabia. This full-time role involves independently executing governance, risk, and compliance activities within Tabby's information security program. The position requires 0-1 years of experience.

Information Security Governance Responsibilities

Maintain and update information security governance framework documentation, policy library, and associated standards and procedures.
Draft and revise information security policies, standards, and baselines, ensuring alignment with regulatory requirements (SAMA CSF, PDPL, NCA ECC, PCI-DSS) and business objectives.
Monitor and track changes in legal, regulatory, and contractual requirements affecting information security, updating the compliance register.
Maintain and update role and responsibility matrices (RACI), governance committee documentation, and reporting packs.
Coordinate security governance committee meetings, including preparing agendas, minutes, and action tracking.
Produce internal and external communication materials related to information security governance, policies, and program updates.

Information Risk Management Responsibilities

Execute information security risk assessments independently, applying the organization's methodology and producing complete risk registers.
Maintain and update the information asset register, tracking asset owners, classifications, and associated risk profiles.
Lead business impact assessment (BIA) data collection activities, coordinating with asset owners and business units.
Conduct control effectiveness evaluations for key information security controls, documenting findings and escalating gaps.
Coordinate third-party information security risk assessments, preparing questionnaires, reviewing vendor responses, and producing risk summaries.
Integrate risk and vulnerability data into procurement reviews, project onboarding, and change management processes.
Prepare periodic risk reports for senior review, highlighting emerging risks and the status of treatment actions.

Compliance and Program Development

Monitor the organization's compliance posture against SAMA CSF, NCA ECC, PDPL, ISO 27001, and PCI-DSS, tracking control status and coordinating remediation.
Coordinate internal and external audit activities, gathering evidence, liaising with auditors, and monitoring remediation progress.
Support the preparation of regulatory submissions, self-assessments, and compliance attestations required by SAMA, NCA, and PCI Council.
Maintain and enhance the security awareness program, developing training materials and tracking completion metrics.
Monitor KPIs and KRIs for the information security program, preparing dashboards for senior management review.
Support the integration of information security requirements into procurement, project management, and change control processes.

Cross-Functional and General GRC Support

Maintain the information security policy, standard, and procedure library, managing version control, review cycles, and distribution.
Support information security initiatives across business and technology teams, providing GRC subject matter expertise.
Conduct information classification reviews and document security requirements for key business and IT projects.
Deliver information security awareness sessions and materials to targeted staff groups.
Provide analytical support for GRC team reporting, data gathering, and program tracking activities.