Information Security Manager

📣 إعلان

منذ ساعة واحدة تقريباً

	نوع العقد	دوام كامل
	طبيعة الوظيفة	بالموقع
	الموقع	مكة المكرمة

وصف الوظيفة

About My Clinic

My Clinic is a leading multispecialty outpatient care provider in Saudi Arabia, established in 2017. The organization focuses on delivering healthcare services that promote longer, healthier, and happier lives, driven by principles of care, collaboration, ambition, and responsibility. My Clinic is currently seeking an Information Security Manager to join its team in Jeddah, Makkah, Saudi Arabia.

Role Overview

The Information Security Manager will lead My Clinic’s information and cybersecurity program, with a primary focus on Governance, Risk, and Compliance (GRC). This role is responsible for ensuring the protection of sensitive patient data and adherence to cybersecurity regulations, including CIS, NIST, and National Cybersecurity Authority (NCA) controls and standards. The manager will develop and execute comprehensive security and risk management strategies, oversee the information security team, and collaborate with IT and business leadership to safeguard data while maintaining operational integrity. This is a full-time position requiring 7-10 years of relevant experience.

Key Responsibilities

Develop, implement, and maintain information security and data protection policies, procedures, and guidelines in alignment with industry standards (*, CIS, NIST, NCA) and regulatory requirements, including KSA’s Personal Data Protection Law (PDPL).
Lead enterprise-wide risk assessments to identify, analyze, and prioritize cybersecurity and data protection risks. Develop and maintain a risk register, implement risk mitigation strategies, and monitor risk treatment plans.
Oversee outsourced Security Operations Center (SOC) activities, ensuring effective monitoring, detection, and response to cybersecurity threats. Review KPIs, evaluate incident handling, and align SOC activities with security objectives.
Ensure organizational compliance with relevant cybersecurity frameworks (CIS, NIST, NCA) and data protection regulations, including PDPL. Conduct regular compliance reviews in alignment with regulatory bodies such as SDAIA and NCA.
Perform Data Protection Impact Assessments (DPIAs) to evaluate and mitigate risks associated with processing personal and sensitive data.
Oversee the development and execution of incident response plans for cybersecurity and data breach incidents, ensuring timely investigation, mitigation, and reporting.
Design and deliver organization-wide training and awareness programs to foster a culture of cybersecurity, risk management, and data protection compliance.
Evaluate and monitor contracts with third-party vendors, data processors, and partners to ensure compliance with cybersecurity and data protection requirements.
Conduct regular audits of cybersecurity practices, data processing activities, and GRC controls, providing recommendations for addressing identified gaps.
Serve as a focal point for IT and business senior management, the risk committee, and IT leadership on cybersecurity risks, data protection strategies, and GRC initiatives.
Oversee and coordinate the execution of IT security operations, working with IT and business senior management to ensure robust protection of My Clinic’s assets.
Lead and mentor the internal information security team, fostering professional growth and ensuring effective execution of security and risk management responsibilities.

Required Experience

7-10 years of experience in information security, with a strong focus on Governance, Risk, and Compliance (GRC).
Demonstrated experience with cybersecurity regulations and frameworks, including CIS, NIST, NCA, and KSA’s Personal Data Protection Law (PDPL).
Experience in leading risk assessments, developing security policies, and managing incident response.
Experience in overseeing outsourced security operations and managing third-party risk.