Chief Information Security Officer

About the Role

Soar is seeking a Chief Information Security Officer (CISO) to lead the company's information security strategy, cybersecurity governance, risk management, and regulatory compliance. This full-time position is based in Riyadh, Saudi Arabia, and requires over 10 years of relevant experience. The CISO will ensure the confidentiality, integrity, and availability of Soar’s information assets, systems, and customer data while supporting business growth and operational resilience.

The role involves establishing and maintaining a robust information security framework aligned with Saudi Central Bank (SAMA) requirements, National Cybersecurity Authority (NCA) controls, and applicable cybersecurity standards and regulations.

Key Responsibilities

• Develop, implement, and maintain Soar’s information security strategy, policies, standards, and procedures.
• Establish an effective information security governance framework aligned with business objectives and regulatory requirements.
• Advise the CEO and senior management on cybersecurity risks, emerging threats, and security priorities.
• Ensure compliance with SAMA Cyber Security Framework (CSF), NCA cybersecurity controls, and other relevant regulatory requirements.
• Lead cybersecurity assessments, control implementation, evidence collection, and remediation activities for regulatory examinations and independent audits.
• Identify, assess, prioritize, and manage information security and cyber risks across the organization, maintaining the information security risk register.
• Oversee security monitoring, threat detection, vulnerability management, and incident response capabilities, including the Security Operations Center (SOC).
• Establish and enforce identity and access management policies, including least-privilege access and segregation of duties.
• Define and oversee security requirements for cloud infrastructure, networks, endpoints, databases, and production systems.
• Work with IT and business continuity teams to integrate cybersecurity requirements into business continuity and disaster recovery plans.
• Establish controls to protect confidential information, personal data, financial information, and customer records.
• Assess and monitor cybersecurity risks associated with outsourced services, cloud providers, and technology vendors.
• Develop and deliver cybersecurity awareness and training programs for employees and contractors.

Key Performance Indicators

• Compliance status against applicable SAMA CSF and NCA requirements.
• Percentage of cybersecurity control gaps remediated within agreed deadlines.
• Number and severity of unresolved critical vulnerabilities.
• Mean time to detect, respond to, and contain security incidents.
• Completion rate of privileged access reviews and access recertification.
• Timeliness of security incident response and regulatory reporting.
• Completion and effectiveness of disaster recovery and cyber resilience exercises.
• Third-party security assessment coverage and remediation performance.
• Employee cybersecurity awareness and training completion rates.

Reporting and Collaboration

The CISO reports to the CEO or another designated executive, in accordance with Soar’s approved governance structure. Key stakeholders include the Board and relevant committees, executive management, Risk, Compliance, Internal Audit, CTO, IT, Engineering, DevOps, Legal, and external cybersecurity service providers.

The role requires appropriate authority, access, and independence to escalate significant cybersecurity risks and report material concerns to the appropriate governance body. While the CISO is responsible for information security governance and oversight, technology and engineering teams remain responsible for implementing and operating assigned security controls.

Important Governance Note

This job description is aligned with Soar’s approved organizational structure, applicable SAMA requirements, cybersecurity independence expectations, and any specific regulatory requirements for appointment or qualifications. Internal Audit will independently assess the effectiveness of information security controls without assuming operational responsibility for them.