Cybersecurity Specialist

About the Role

Yanbu Aramco Sinopec Refining Company (YASREF) is seeking a highly experienced Cybersecurity Specialist to join their team in Yanbu. This full-time role requires over 10 years of experience and focuses on defining, communicating, and controlling robust information security and cybersecurity governance programs within the organization.

Key Responsibilities

• Guide and implement cybersecurity practices and governance across the organization.
• Defend computers, servers, mobile devices, electronic systems, networks, and data from malicious attacks.
• Establish and implement frameworks and processes for continual adherence to YASREF's internal and external mandates.
• Implement and audit controls to protect company and third-party information from data breaches and cyber-attacks.
• Develop and update guidelines and procedures for the Information Security Division to meet standard guidelines and compliance requirements.
• Ensure adherence to the Risk Assessment process as per ISO 31000, in line with Corporate Enterprise Risk Management methodology.
• Conduct internal technical and process risk assessments as part of self-assessment activities.
• Review and measure the performance and effectiveness of implemented OT & IT controls, mitigating identified IT risks and gaps.
• Research and recommend appropriate technology controls for security compromise prevention, detection, and response.
• Review Information Security postures through periodic internal security audits and random audits at vendor facilities.
• Facilitate and maintain audit evidence and closure of findings for internal audits including Internal Controls Framework, ERM, ISO 27001, ISA 99 / IEC 62443, and Corporate Governance Audits.
• Align IT and OT Controls with NIST–CSF, 800-82, 800-53 requirements to enhance maturity assessments for joint ventures, SAMA, NCA, HCIS, and other industry best practices.
• Develop and implement a data classification and privacy framework, assisting business departments with data categorization.
• Establish a unified IT and OT governance body with an advisory board to oversee the development of integrated IT/OT security guidelines and procedures.

Communication and Reporting

The specialist will report regularly to hierarchy, implement pertinent policies, exchange information, and discuss relevant KPIs/performance parameters. This role involves providing services to other internal organizations.

Required Skills and Activities

• Maintain and continually improve IT Governance functions.
• Review and analyze existing processes including Organizational Information Security, Access Controls, Change Management, Human Resource Security, Incident Management, Asset Management, Operational and Communicational Security, System development and maintenance, Physical Security, IT Continuity, and Compliance controls.
• Conduct information security awareness training and phishing simulation exercises for YASREF users.
• Design and develop training programs to enhance security awareness through various media.
• Study and document resources required in disaster scenarios, identifying recovery priorities and categorizing processes.
• Validate and analyze risks of organizational disruptions, prioritize activities, and mitigate problems in line with business continuity objectives.
• Prepare, validate, and deliver comprehensive OT and IT continuity requirement sheets with Key Risk Areas (KRA) and Key Performance Indicators (KPI).
• Provide support for Industrial Control Systems, Electrical Automation Systems, Cybersecurity systems, and network operations.
• Participate in cybersecurity research and stay informed on the latest security issues, actively engaging with the higher education cybersecurity community.

Qualifications and Experience

Candidates must possess over 15 years of relevant experience in cybersecurity and information security governance.

Application Process

Qualified candidates are encouraged to apply for this full-time position in Yanbu.