Cybersecurity Specialist

About the Role

Yanbu Aramco Sinopec Refining Company (YASREF) Ltd. is seeking a Cybersecurity Specialist to join their team in Al Madinah, specifically in Yanbu or Medina. This full-time role involves defining, communicating, and controlling a robust information security and cybersecurity governance program. The specialist will guide and implement cybersecurity practices within the organization, defending critical systems and data from malicious attacks.

Key Responsibilities

• Develop and update guidelines and procedures for the Information Security Division to meet standard guidelines and compliance requirements.
• Ensure adherence to the Risk Assessment process as per ISO 31000, aligned with the Corporate Enterprise Risk Management methodology.
• Conduct internal technical and process risk assessments as part of self-assessment activities.
• Review and measure the performance and effectiveness of implemented OT & IT controls, mitigating identified IT risks and gaps.
• Research and recommend appropriate technology controls for preventing, detecting, and responding to security compromises.
• Schedule and perform internal security audits periodically, including random security audits at vendor facilities.
• Facilitate and maintain audit evidence and ensure closure of findings for all internal audits (Internal Controls Framework, ERM, ISO 27001, ISA 99 / IEC 62443, Corporate Governance).
• Adopt and align existing IT and OT controls with NIST–CSF, 800-82, 800-53 requirements to enhance maturity assessments for joint ventures, SAMA, NCA, and HCIS, among other industry best practices.
• Develop and implement a data classification and privacy framework, assisting business departments with data categorization to apply adequate technical controls.
• Establish a unified IT and OT governance body with an advisory board to oversee the development of common IT guidelines and procedures for integrated IT/OT security.
• Maintain and continually improve IT Governance functions.
• Review and analyze existing processes including Organizational Information Security, Access Controls, Change Management, Human Resource Security, Incident Management, Asset Management, Operational and Communicational Security, System Development and Maintenance, Physical Security, IT Continuity, and Compliance controls.
• Impart information security awareness training and conduct phishing simulation exercises.
• Design and develop training programs to enhance security awareness levels through various channels.
• Study and document required resources, including personnel, for disaster scenarios and identify recovery priorities.
• Validate and analyze risks of organizational disruptions, prioritize activities, and mitigate problems in line with business continuity objectives.
• Prepare, validate, and deliver comprehensive OT and IT continuity requirement sheets with Key Risk Areas (KRA) and Key Performance Indicators (KPI).
• Provide support for Industrial Control Systems, Electrical Automation Systems, Cybersecurity systems, and network operations.
• Participate in cybersecurity research and stay informed of the latest security issues, actively engaging with the higher education cybersecurity community.

Qualifications and Experience

• A minimum of 10 years of experience in cybersecurity or a related field.
• Demonstrated ability to establish and implement frameworks and processes for adherence to internal and external mandates.
• Experience in implementing and auditing controls to protect company and third-party information from data breaches and cyber-attacks.

Communication and Collaboration

The role requires regular internal reporting and communication with hierarchy. The specialist will implement pertinent policies, exchange information, discuss relevant KPIs, and provide services to other organizations within YASREF. External communication is not a primary component of this role.

Work Environment

This is a full-time position based in Al Madinah, with work locations in Yanbu or Medina. The role involves working within a team dedicated to maintaining and enhancing the cybersecurity posture of Yanbu Aramco Sinopec Refining Company (YASREF) Ltd.

Application Process

Interested candidates who meet the qualifications are encouraged to apply. Salary details will be discussed during the interview process.