Compliance Manager📣 Job Ad

About the Role

Acuative Middle East is seeking a Compliance Manager to oversee its Governance, Risk, and Compliance (GRC) program. This full-time position is based in Makkah and Jeddah, Saudi Arabia, and requires 5-10 years of relevant experience.

Role Overview

The Compliance Manager will lead the organization's cybersecurity governance, risk management, and compliance initiatives. This role is crucial for ensuring the effective implementation and continuous improvement of security governance practices, while maintaining adherence to applicable regulatory and industry frameworks. The Compliance Manager will serve as a key advisor on cybersecurity governance and regulatory compliance, collaborating with executive leadership, business units, auditors, and technology teams to establish robust security controls, manage cyber risks, ensure audit readiness, and drive ongoing compliance efforts.

Key Responsibilities

• Lead the organization's Cybersecurity Governance Program and Information Security Management System (ISMS).
• Ensure compliance with frameworks including NCA Essential Cybersecurity Controls (ECC), NIST Cybersecurity Framework (CSF), NIST SP 800-53, ISO/IEC 27001, ISO/IEC 27002, and ICAO Cybersecurity Standards.
• Develop and maintain cybersecurity policies, standards, procedures, and governance documentation.
• Lead governance committees and coordinate Security Steering Committee meetings.
• Conduct cybersecurity maturity assessments and develop improvement plans.
• Lead the enterprise cybersecurity risk management program, maintaining the risk register and conducting risk assessments.
• Review and approve risk treatment plans and monitor remediation activities.
• Lead internal and external cybersecurity audits and coordinate compliance assessments.
• Oversee security control assessments, track audit findings, and support third-party risk assessments.
• Develop executive dashboards and reports on governance, compliance, and risk posture.

Required Qualifications and Experience

• Bachelor's degree in Cybersecurity, Information Security, Information Technology, Risk Management, Business Administration, or a related field.
• Minimum of 7 years of experience in Governance, Risk & Compliance (GRC), Information Security, Audit, or Cybersecurity.
• Minimum of 3 years in a leadership or senior GRC role.
• Proven experience implementing and managing enterprise GRC programs.
• Hands-on experience with cybersecurity risk assessments and risk register management.
• Experience leading internal and external audits.
• Strong knowledge of cybersecurity governance frameworks and regulatory compliance.

Technical Skills and Frameworks

Proficiency is required in:

• Governance & Risk: Cybersecurity Governance, Enterprise Risk Management, Risk Register Management, Security Control Assessments, Compliance Assessments, Audit Management, Policy & Standards Development, Third-Party Risk Management, Information Security Management Systems (ISMS).
• Frameworks: National Cybersecurity Authority (NCA) Essential Cybersecurity Controls (ECC), NIST Cybersecurity Framework (CSF), NIST SP 800-53, ISO/IEC 27001, ISO/IEC 27002, ISO 31000 Risk Management.
• Reporting & Tools: Microsoft Excel (Advanced), Microsoft Power BI, Microsoft Office Suite, and experience preparing executive dashboards and governance reports.

Preferred Qualifications and Certifications

• Experience in government, aviation, telecommunications, financial services, or other highly regulated industries.
• Experience supporting ICAO cybersecurity compliance or aviation regulatory environments.
• Experience implementing or administering GRC platforms (*, ServiceNow GRC, RSA Archer, OneTrust, MetricStream, AuditBoard).
• Experience leading ISO/IEC 27001 certification or surveillance audits.
• Familiarity with COBIT and CIS Critical Security Controls.
• Relevant certifications such as CISSP, CRISC, CISA, CGRC, ISO/IEC 27001 Lead Implementer, ISO/IEC 27001 Lead Auditor, or COBIT Foundation are advantageous.