Cybersecurity GRC Specialist

Role Overview

Cybersecurity GRC Specialist at Ninja. The role will support cybersecurity governance, risk, and compliance activities across the Group.

Role Purpose

Maintain cybersecurity policies and controls, coordinate risk assessments and compliance evidence, track remediation actions, and support regulatory, audit, and assurance activities.

Key Responsibilities

Governance & Policy

• Support the development and maintenance of cybersecurity policies, standards, procedures, and governance records.
• Maintain security exceptions, risk acceptance records, and required follow-ups.
• Identify control gaps and opportunities to improve cybersecurity governance processes.

Risk Management

• Coordinate cybersecurity risk assessments for systems, projects, suppliers, and business initiatives.
• Maintain risk registers, track treatment plans, and follow up on overdue actions.
• Support cybersecurity due diligence and risk reviews for third parties and service providers.

Compliance & Assurance

• Support cybersecurity compliance assessments against regulatory and internal requirements.
• Coordinate the collection, validation, and organization of compliance and audit evidence.
• Support Internal Audit, external assessments, and regulatory reviews by preparing required cybersecurity evidence.
• Track audit findings, remediation actions, and closure evidence.

Reporting

• Prepare GRC reports, dashboards, and management updates.

Qualifications & Experience

• Bachelor's degree in Cybersecurity, Information Security, Information Technology, Risk Management, Business Administration, or a related field.
• 2–4 years of experience in cybersecurity GRC, information security, risk, compliance, or a related function.
• Good understanding of cybersecurity governance, risk assessment, control testing, and compliance.
• Familiarity with Saudi cybersecurity requirements and information security frameworks.

Skills & Competencies

• Strong documentation, analytical, and stakeholder coordination skills.
• Ability to communicate effectively with both technical and non-technical stakeholders.
• Professional proficiency in Arabic and English.

Additional Information

• Certifications such as ISO 27001, CRISC, CISA, CGRC, or equivalent are preferred.