Cybersecurity Risk and Resilience Manager

About DirectFN

DirectFN, now part of Saudi Tadawul Group / WAMID, is a prominent Financial Technology software and Content provider within the Capital Market Industry (CMI). The company specializes in delivering brokerage, asset, and custody management solutions, alongside market information screens as productized services. DirectFN's offerings support financial institutions and individuals in optimizing operations and enhancing client satisfaction.

The Role of Cybersecurity Risk and Resilience Manager

DirectFN is seeking a Cybersecurity Risk and Resilience Manager to oversee and implement the organization's cybersecurity governance, enterprise risk management, and business continuity programs. This full-time position is based in Riyadh, Saudi Arabia, and involves ensuring adherence to relevant cybersecurity frameworks, regulatory standards, and risk management policies. The role is critical for protecting the integrity, availability, and confidentiality of DirectFN's systems, financial data platforms, and client-facing services. The Manager will collaborate with IT, technology, legal, and compliance teams, reporting directly to the COO and supervising a cybersecurity specialist.

Key Responsibilities

• Manage cybersecurity governance, including alignment with ISO 27001, NIST, and SAMA Cybersecurity Framework (CSF).
• Oversee the development, maintenance, and enforcement of cybersecurity policies.
• Conduct risk assessments, vulnerability management, and incident response planning.
• Operate the end-to-end enterprise risk program, covering identification, assessment, treatment, and monitoring of risks.
• Maintain a risk register, apply consistent scoring methodologies, and conduct quarterly risk reviews.
• Lead the development, maintenance, and testing of Business Continuity Plans (BCP) and conduct Business Impact Assessments (BIA).
• Ensure operational resilience practices comply with regulatory mandates, including SAMA and NCA requirements.
• Maintain knowledge of regulatory frameworks (SAMA, NCA, GDPR, ISO 27001) and ensure compliance.
• Manage the cybersecurity incident response process from detection to post-incident review.
• Provide oversight to the Cybersecurity Specialist and engage cross-functionally to embed security awareness.

Qualifications and Experience

• A minimum of 5-10 years of experience in cybersecurity, risk management, or business continuity.
• Demonstrated experience with cybersecurity frameworks such as ISO 27001, NIST, and SAMA CSF.
• Proficiency in enterprise risk management methodologies and maintaining risk registers.
• Experience in developing and testing Business Continuity Plans and conducting Business Impact Assessments.
• Familiarity with regulatory requirements from SAMA and NCA.
• Ability to manage third-party vendor cybersecurity assessments and compliance.
• Experience in coordinating internal and external audits (*, ISO 27001, SOC 2).

Key Performance Areas

• Regulatory Compliance: Consistent adherence to SAMA, NCA, and international cybersecurity standards.
• Risk Posture: Maintenance of an up-to-date risk register with active treatment plans and clear ownership.
• Incident Readiness: Documented and tested incident response and business continuity plans for effective disruption management.
• Audit Readiness: Successful internal and external audits with minimal findings and timely corrective action closure.
• Organizational Awareness: Enhanced security and risk awareness across DirectFN through governance, training, and cross-functional engagement.

Work Environment

This role is a full-time position based in Riyadh, Saudi Arabia. The successful candidate will work within a leading fintech company in the Saudi capital markets ecosystem, collaborating with various internal teams including IT, technology, legal, and compliance, and reporting to the COO.