Chief Information Security Officer

About the Role

Soar is seeking a Chief Information Security Officer (CISO) to lead the company's information security strategy, cybersecurity governance, risk management, and regulatory compliance. This full-time role is based in Riyadh, Saudi Arabia, and is critical for ensuring the confidentiality, integrity, and availability of Soar’s information assets, systems, and customer data while supporting business growth and operational resilience. The CISO will establish and maintain a robust information security framework aligned with Saudi Central Bank (SAMA) requirements, National Cybersecurity Authority (NCA) controls, and applicable cybersecurity standards.

Key Responsibilities

• Develop, implement, and maintain Soar’s information security strategy, policies, standards, and procedures.
• Establish an effective information security governance framework aligned with business objectives and regulatory requirements.
• Advise the CEO and senior management on cybersecurity risks, emerging threats, and security priorities.
• Ensure compliance with SAMA Cyber Security Framework (CSF), NCA cybersecurity controls, and other relevant regulatory requirements.
• Lead cybersecurity assessments, control implementation, evidence collection, and remediation activities related to regulatory examinations and independent audits.
• Identify, assess, prioritize, and manage information security and cyber risks across the organization, maintaining the information security risk register.
• Oversee security monitoring, threat detection, vulnerability management, and incident response capabilities, including the Security Operations Center (SOC).
• Establish and enforce identity and access management policies, including least-privilege access and segregation of duties.
• Define and oversee security requirements for cloud infrastructure, networks, endpoints, databases, and production systems.
• Work with IT and business continuity teams to integrate cybersecurity requirements into business continuity and disaster recovery plans.
• Establish appropriate controls to protect confidential information, personal data, financial information, and customer records.
• Assess and monitor cybersecurity risks associated with outsourced services, cloud providers, and technology vendors.
• Develop and deliver cybersecurity awareness and training programs for employees and contractors.

Key Performance Indicators

• Compliance status against applicable SAMA CSF and NCA requirements.
• Percentage of cybersecurity control gaps remediated within agreed deadlines.
• Mean time to detect, respond to, and contain security incidents.
• Completion rate of privileged access reviews and access recertification.
• Employee cybersecurity awareness and training completion rates.

Reporting and Collaboration

The CISO reports to the CEO or another designated executive, in accordance with Soar’s approved governance structure. Key stakeholders include the Board and relevant committees, executive management, Risk, Compliance, Internal Audit, CTO, IT, Engineering, DevOps, Legal, and external cybersecurity service providers. The role requires appropriate authority, access, and independence to escalate significant cybersecurity risks and report material concerns to the appropriate governance body.

Qualifications and Experience

• A minimum of 10 years of experience in information security.
• Demonstrated expertise in leading information security strategy, governance, risk management, and regulatory compliance.
• Strong understanding of SAMA Cyber Security Framework (CSF) and NCA cybersecurity controls.
• Experience in overseeing security operations, incident response, and identity and access management.
• Ability to define and oversee security requirements for cloud infrastructure, networks, and applications.

Important Governance Note

The CISO is responsible for information security governance and oversight. Technology and engineering teams remain responsible for implementing and operating the security controls assigned to them. Internal Audit should independently assess the effectiveness of information security controls without assuming operational responsibility for them. This job description is aligned with Soar’s approved organizational structure, applicable SAMA requirements, cybersecurity independence expectations, and any specific regulatory requirements for appointment or qualifications.