Cybersecurity Incident Management Specialist

About the Role

flynas is seeking a Cybersecurity Incident Management Specialist to join their team in Riyadh, Saudi Arabia. This full-time role is responsible for coordinating and managing the complete cybersecurity incident response lifecycle, from assessment and investigation to recovery and closure. The specialist will work closely with internal stakeholders, cybersecurity service providers, and third parties to ensure effective and timely responses to incidents.

Role Purpose

The primary purpose of this position is to manage the end-to-end cybersecurity incident response process. This includes maintaining accurate incident records, supporting regulatory reporting, tracking corrective actions, and contributing to the continuous improvement of incident response capabilities. The role involves coordinating various aspects of incident management to ensure organizational security and compliance.

Key Responsibilities

• Receive and assess potential cybersecurity incidents from various reporting channels.
• Validate, classify, prioritize, and manage incidents based on approved criteria, severity, and business impact.
• Coordinate end-to-end incident response activities, including investigation, containment, eradication, recovery, and closure, with relevant teams and third parties.
• Collaborate with the SOC/MSSP and cybersecurity teams to gather technical analysis, IOCs, threat intelligence, and logs for investigations.
• Escalate critical and high-severity incidents according to the approved matrix and ensure timely communication with management and stakeholders.
• Coordinate with IT, system owners, business units, Legal, Data Protection, Business Continuity, Communications, and HR as required by incident nature and impact.
• Maintain complete and accurate incident records, including classification, impact, investigation details, decisions, actions, evidence, communications, timelines, and resolution.
• Ensure proper preservation and handling of incident-related evidence and support digital forensic activities.
• Support assessment of incidents against applicable NCA and other regulatory reporting requirements, coordinating preparation of necessary information and submissions.
• Conduct and coordinate post-incident reviews and Root Cause Analysis (RCA) for applicable incidents.
• Identify corrective and preventive actions, assign owners, and track implementation through closure.
• Validate completion of agreed recovery and remediation activities before recommending incident closure.
• Maintain and periodically review incident response procedures, playbooks, contact lists, and escalation matrices.
• Participate in incident response exercises and simulations, documenting identified gaps and improvement actions.
• Monitor incident response performance against defined SLAs and KPIs, preparing periodic incident management reports.
• Identify recurring incident patterns, affected assets, attack vectors, and control weaknesses to support continuous improvement.
• Support coordination with external incident response, digital forensics, and threat intelligence service providers when necessary.

Experience and Qualifications

• A minimum of 2-5 years of experience in cybersecurity incident management or a related field is required.

Work Environment

This is a full-time position based in Riyadh, Saudi Arabia, within a dynamic environment focused on maintaining robust cybersecurity defenses for flynas.