Information Security Manager

About the Role

Jeddah Central Development Company (JCDC) is seeking an Information Security Manager to lead and manage all activities related to protecting the company's digital and physical information assets. This full-time role is based in Makkah, specifically in Jeddah or Makkah, and involves operating within the Information Security division to implement and maintain data security policies and procedures. The manager will ensure JCDC data remains secure and compliant with all regulatory requirements.

Key Responsibilities

• Manage the implementation of JCDC's data security strategy, ensuring alignment with business objectives.
• Develop and enforce data security procedures, general instructions, and administrative procedures in line with company goals and compliance.
• Respond to and manage data security incidents, including post-incident analysis and implementing preventive measures.
• Collaborate with cross-functional teams to protect defined data asset inventories and integrate data security best practices across the organization.
• Execute training and awareness programs to educate employees on data security practices and the importance of protecting classified information.
• Select and implement data security tools and technologies to enhance the security posture.
• Monitor industry trends, threats, and best practices in data security to keep policies and procedures current.
• Provide expert advice and guidance on data security matters to senior management and stakeholders.

Identity and Access Management

• Collaborate with data owners to define and establish access controls for classified data resources.
• Conduct and coordinate reviews of access controls and permissions for classified data resources.
• Manage the process for granting, modifying, and revoking access to data resources, ensuring adherence to policies and authorization by data owners.
• Manage approvals for identity and access management requests across various systems (database, dataset, USB, SAP, cloud drives, e-vaults, internet URL access, DLP, RMS) to prevent data breaches.
• Monitor user access review activities across JCD data systems.

Data Privacy and Compliance

• Develop and implement processes for handling data subject requests efficiently.
• Collaborate with all departments to integrate data privacy best practices throughout the organization.
• Monitor the implementation of data privacy law provisions and manage personal data requests in collaboration with the cybersecurity GRC.
• Select and implement data privacy tools and technologies to enhance the security posture.
• Lead the process of conducting Privacy Impact Assessments (PIAs) and Data Protection Impact Assessments (DPIAs) for new and existing projects.
• Manage the organization's data breach response and notification procedures, ensuring timely and coordinated responses to incidents.

Strategic and Operational Management

• Ensure effective cascading of divisional strategy into sectional business plans for vertical alignment and horizontal integration.
• Manage the achievement of assigned objectives by leading the designated section, setting individual objectives, managing performance, and developing staff.
• Lead talent development initiatives for the assigned section, ensuring talent availability to meet business requirements.
• Manage budget preparation, recommend sectional budgets, and monitor financial performance against the budget.
• Ensure effective implementation of policies, procedures, and controls covering all areas of assigned sectional activity.
• Lead the identification of opportunities for continuous improvement and sustainability of systems, processes, and practices.
• Ensure timely and accurate preparation of all department reports that meet JCDC requirements and quality standards.

Qualifications and Experience

Candidates should possess 5-10 years of relevant experience in information security management. The role requires a strong understanding of data security strategies, regulatory compliance, and incident management. Experience in identity and access management, as well as data privacy principles, is essential.