Information Security Manager

About My Clinic

My Clinic is a leading multispecialty outpatient care provider in Saudi Arabia, established in 2017. The organization focuses on delivering healthcare services through innovation and a commitment to care, collaboration, ambition, and responsibility. My Clinic aims to help individuals achieve longer, healthier, and happier lives.

The Role of Information Security Manager

My Clinic is seeking an Information Security Manager to lead its information and cybersecurity program. This full-time position, located in Jeddah, Makkah, Saudi Arabia, focuses on Governance, Risk, and Compliance (GRC) to protect sensitive patient data and ensure adherence to cybersecurity regulations. The role involves developing and executing security and risk management strategies, managing the information security team, and collaborating with IT and business leadership to safeguard data while maintaining operational integrity.

Key Responsibilities

• Develop, implement, and maintain information security and data protection policies, procedures, and guidelines in alignment with industry standards (CIS, NIST, NCA) and regulatory requirements, including KSA’s Personal Data Protection Law (PDPL).
• Lead enterprise-wide risk assessments to identify, analyze, and prioritize cybersecurity and data protection risks. Develop and maintain a risk register, implement mitigation strategies, and monitor treatment plans.
• Oversee outsourced Security Operations Center (SOC) activities, ensuring effective monitoring, detection, and response to cybersecurity threats. Review KPIs, evaluate incident handling processes, and align SOC activities with security objectives.
• Ensure organizational compliance with cybersecurity frameworks (CIS, NIST, NCA) and data protection regulations (PDPL). Conduct regular compliance reviews to meet requirements from bodies such as SDAIA and NCA.
• Perform Data Protection Impact Assessments (DPIAs) to evaluate and mitigate risks associated with processing personal and sensitive data.
• Oversee the development and execution of incident response plans for cybersecurity and data breach incidents, ensuring timely investigation, mitigation, and reporting.
• Design and deliver organization-wide training and awareness programs on cybersecurity, risk management, and data protection compliance.
• Evaluate and monitor contracts with third-party vendors, data processors, and partners to ensure compliance with cybersecurity and data protection requirements.
• Conduct regular audits of cybersecurity practices, data processing activities, and GRC controls, providing recommendations for identified gaps.
• Serve as a focal point for IT and business senior management, the risk committee, and IT leadership on cybersecurity risks, data protection strategies, and GRC initiatives.
• Oversee and coordinate the execution of IT security operations, working with IT and business senior management to ensure robust protection of My Clinic’s assets.
• Lead and mentor the internal information security team, fostering professional growth and ensuring effective execution of security and risk management responsibilities.

Qualifications and Experience

• A minimum of 5-10 years of experience in information security, with a focus on GRC.
• Demonstrated understanding of cybersecurity regulations and frameworks, including CIS, NIST, NCA controls and standards, and KSA’s Personal Data Protection Law (PDPL).
• Experience in leading risk assessments, developing security policies, and managing incident response.
• Ability to oversee outsourced SOC operations and manage third-party risk.
• Experience in team leadership and development within an information security context.

Location and Work Type

This is a full-time position based in Jeddah, Makkah, Saudi Arabia.

Application Process

Candidates who meet the qualifications are encouraged to apply.