Chief Information Security Officer

About Flooss

AL-AN Alkhaligia for Consumer Microfinance Company (Flooss) provides consumer microfinance solutions within Saudi Arabia. Operating in the regulated financial sector, Flooss is supervised by the Saudi Central Bank (SAMA). The company is focused on building a customer-centric, technology-enabled, and well-governed organization.

The Role of Chief Information Security Officer

Flooss is seeking a Chief Information Security Officer (CISO) to lead its independent Cybersecurity function in Riyadh, Saudi Arabia. This full-time role is responsible for protecting the company's information assets, customer data, and digital services from cyber threats, while ensuring full compliance with SAMA and other applicable regulatory requirements. The CISO will own the cybersecurity strategy, governance framework, risk management, and security operations, collaborating with the IT Manager, Risk, Compliance, and executive management to integrate security across the business.

Key Responsibilities

• Define and execute the cybersecurity strategy and roadmap in alignment with business strategy and risk appetite.
• Establish and maintain the cybersecurity governance framework, policies, standards, and procedures.
• Manage the cybersecurity budget and investment priorities.
• Report cybersecurity posture, risks, and key metrics to executive management, the Board, and relevant committees.
• Ensure compliance with the SAMA Cyber Security Framework, NCA Essential Cybersecurity Controls, and other applicable regulations.
• Identify, assess, and manage cybersecurity risks across systems, processes, projects, and third parties.
• Oversee security monitoring and threat detection, including managing vulnerability, penetration testing, and threat intelligence programs.
• Lead cyber incident response, investigation, and reporting to SAMA and other authorities within required timelines.
• Define security architecture standards and ensure secure-by-design principles across infrastructure, cloud, applications, APIs, and digital channels.
• Lead data protection controls in coordination with the Data Protection Officer, in line with the Personal Data Protection Law (PDPL).
• Assess and monitor the cybersecurity posture of vendors and outsourcing arrangements, in line with SAMA outsourcing requirements.
• Lead cybersecurity awareness and training programs for employees, management, and the Board.
• Lead, coach, and develop the cybersecurity team, including building succession plans and developing national cybersecurity talent.

Qualifications and Experience

• A minimum of 10 years of experience in cybersecurity.
• Demonstrated ability to define and execute cybersecurity strategies and governance frameworks.
• Experience with SAMA Cyber Security Framework, NCA Essential Cybersecurity Controls, and other relevant regulations.
• Proven leadership in security operations, incident response, and security architecture.

Work Environment

This is a full-time position based in Riyadh, Saudi Arabia. The Chief Information Security Officer will work within a regulated financial sector environment, collaborating with various internal and external stakeholders to maintain a robust security posture.