Cybersecurity GRC Specialist(Saudi National only)📣 Job Ad

About SiFi

SiFi is a B2B FinTech company specializing in spend management and card issuance solutions. Based in Riyadh, Saudi Arabia, SiFi supports companies in gaining control over their spending, streamlining expense workflows, and operating with enhanced efficiency.

The Role of Cybersecurity GRC Specialist

SiFi is seeking a Cybersecurity GRC Specialist to join its team. This full-time position, open to Saudi Nationals only, plays a critical role in maintaining SiFi’s cybersecurity compliance posture and ensuring audit readiness across all regulatory frameworks. The specialist is responsible for managing the full Governance, Risk, and Compliance (GRC) lifecycle, which includes evidence management, policy governance, risk tracking, and KPI/KRI reporting. The objective is to ensure that all cybersecurity controls are measurable, defensible, and aligned with regulatory expectations.

Key Responsibilities

• Maintain and manage the compliance tracker across SAMA CSF, PDPL/NDMO, and PCI-DSS.
• Own the full evidence lifecycle, including collection, validation, and documentation, to ensure continuous audit readiness with traceable, control-aligned evidence.
• Track regulatory findings and remediation plans, ensuring their timely closure.
• Provide regular compliance status reports to the CISO and relevant committees.
• Develop and maintain cybersecurity policies, standards, and procedures, ensuring documentation aligns with SiFi’s governance structure and regulatory expectations.
• Manage the document lifecycle, including versioning, approvals, and reviews, and map all policies and procedures to SAMA CSF controls.
• Maintain and update the cybersecurity risk register.
• Conduct third-party risk assessments (TPRA) and vendor due diligence.
• Support risk reviews and reporting cycles, collaborating with Risk and Compliance teams to align enterprise risk frameworks.
• Collect and validate cybersecurity KPIs/KRIs from relevant stakeholders and maintain a centralized tracker.
• Prepare periodic reports with trend analysis to support regulatory maturity (Level 3+).
• Identify and escalate performance gaps.

Required Qualifications

• 1–3 years of experience in a dedicated Cybersecurity GRC role.
• Hands-on experience with SAMA CSF compliance within regulated entities.
• Experience in audit evidence preparation and regulatory assessments.
• Strong background in drafting cybersecurity policies and procedures.
• Experience using GRC platforms (*, Archer, ServiceNow GRC, OneTrust).
• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or a related field.
• Certifications such as ISO 27001 Lead Implementer / Lead Auditor, Security+, (ISC)2 CC, CGRC, CISA, or CRISC.
• Proficiency in both English and Arabic.

Preferred Qualifications

• Experience with PDPL and NDMO regulations.
• PCI-DSS compliance exposure.
• Knowledge of cloud security (AWS, Azure, GCP, OCI).
• Experience in fintech or financial services.
• Familiarity with frameworks like ISO 27001, NIST, COBIT.

Location and Work Type

This is a full-time position located in Riyadh, Saudi Arabia. The role is exclusively for Saudi Nationals.