GRC Risk and Compliance Consultant

About the Role

Women First Jobs is seeking an experienced GRC Risk and Compliance Consultant to join their team in Riyadh. This full-time role involves supporting clients in establishing, implementing, and improving their Governance, Risk, and Compliance programs. The consultant will work across various areas including information security governance, risk management, compliance assessments, policy development, and security control implementation.

Key Responsibilities

• Lead and execute Governance, Risk, and Compliance (GRC) consulting engagements.
• Conduct information security and cybersecurity gap assessments against applicable standards and regulatory requirements.
• Perform risk assessments, including risk identification, analysis, and treatment activities.
• Develop and maintain Information Security Policies, Standards, Procedures, Risk Registers, Statement of Applicability (SoA), Control Matrices, Business Impact Assessments, and Risk Treatment Plans.
• Support clients in implementing and improving Information Security Management Systems (ISMS).
• Conduct compliance assessments against frameworks such as ISO 27001, ISO 22301, NIST CSF, NIST 800-53, CIS Controls, COBIT, SOC 2, PCI DSS, and applicable UAE/GCC regulatory requirements.
• Support organizations in ISO 27001 implementation and certification readiness.
• Perform internal audits and readiness assessments, identifying control gaps and developing practical remediation plans.
• Support customers during external certification and regulatory audits.
• Conduct third-party/vendor security risk assessments and develop/maintain Third-Party Risk Management (TPRM) programs.
• Support Business Continuity Management and Disaster Recovery assessments where applicable.
• Review security policies, procedures, processes, and technical/organizational controls.
• Prepare detailed assessment reports, audit reports, and management presentations.
• Provide remediation recommendations and track the closure of identified gaps.
• Conduct periodic risk and compliance reviews.
• Support regulatory and customer compliance requirements.
• Participate in customer workshops, management meetings, and compliance discussions.
• Support pre-sales activities, including RFP/RFQ responses and solution development.

Experience and Qualifications

• A minimum of 5-10 years of experience in GRC consulting or a related field.
• Demonstrated experience in establishing, implementing, and improving Governance, Risk, and Compliance programs.
• Proficiency in information security governance, risk management, and compliance assessments.
• Familiarity with various security frameworks and regulatory requirements.

Work Environment

This is a full-time position based in Riyadh, Saudi Arabia. The role involves working with a diverse client base to enhance their security posture and compliance adherence.