Cybersecurity GRC Manager

About Hala

Hala is a fintech company operating in the MENAP region, focused on redefining financial services for SMEs. The company aims to empower SMEs with financial and technological tools to manage and grow their businesses. Established in 2017, Hala holds multiple entities in UAE, Saudi Arabia, and Egypt, including Hala Payments and Hala Logistics. It offers solutions for digitizing payments and managing sales and operations, and is licensed by the Saudi Arabian Central Bank. This full-time position for a Cybersecurity GRC Manager is based in Riyadh.

Role Overview

The Cybersecurity GRC Manager will be responsible for developing and managing the organization's information security governance, risk management, and regulatory compliance programs. This role involves ensuring the company's cybersecurity strategy aligns with business objectives and maintaining adherence to relevant industry standards and regulations.

Key Responsibilities

• Develop and improve the Information Security Governance framework, policies, standards, and procedures.
• Lead the creation and execution of the Cyber Security Strategy, aligning it with business goals.
• Report regularly to the Board of Directors and executive management on cybersecurity status.
• Establish and manage a security metrics and KPI program to measure program effectiveness.
• Oversee the information security budget, ensuring effective resource allocation for risk management.
• Design and manage an enterprise-wide Cyber Security Risk Management program.
• Conduct regular risk assessments, including Business Impact Analysis (BIA), to identify and evaluate information security risks.
• Facilitate risk treatment planning with business and technology owners.
• Manage the vendor risk management program, assessing third-party security posture, especially for cloud service providers and payment gateways.
• Integrate risk management into the Software Development Life Cycle (SDLC) and change management processes.
• Serve as the primary contact for regulatory examinations and audits related to cybersecurity (*, SAMA, CMA).
• Ensure continuous compliance with SAMA's Cyber Security Framework (CSF) and PCI DSS requirements.
• Manage the process for obtaining and maintaining necessary regulatory licenses and certifications from a cybersecurity perspective.
• Prepare and submit accurate regulatory reports and evidence requests.
• Monitor the regulatory landscape for changes and advise on required adjustments.
• Manage internal and external security audits, including coordination and tracking remediation.
• Develop and maintain a control testing program to validate security control effectiveness.
• Manage the remediation of all audit and assessment findings.
• Develop and deliver a security awareness and training program tailored to different roles.
• Champion a strong security culture within the organization.

Work Environment and Development

Hala fosters an inclusive and diverse culture, supporting remote, in-office, and hybrid work setups. The company prioritizes personal development, offering regular training and an annual learning stipend. Employees work in a hyper-growth environment with a team representing over 30 nationalities across 7 countries. The role offers autonomy, mentoring, and challenging goals, providing opportunities for professional growth within the company.