Chief Information Security Officer

Summary

The Chief Information Security Officer (CISO) is responsible for leading the organization's cybersecurity function, protecting information assets, systems, and services, and ensuring compliance with the Saudi Central Bank Cyber Security Framework (SAMA CSF). The role oversees cybersecurity strategy, governance, risk management, regulatory compliance, and incident response, with the objective of achieving and maintaining a minimum targeted cybersecurity maturity level of Level 3.

Job Responsibilities

• Develop and implement the cybersecurity strategy, policies, standards, and procedures in alignment with organizational objectives and regulatory requirements.
• Establish and maintain cybersecurity governance frameworks, define roles and responsibilities, and integrate security requirements into business projects and initiatives.
• Report cybersecurity risks, maturity levels, compliance status, and key performance indicators to senior management, the Cybersecurity Committee, and the Board of Directors.
• Develop and manage the cybersecurity budget, lead the cybersecurity team, and oversee employee development and awareness programs.
• Establish and oversee cybersecurity risk management processes, maintain the risk register, conduct risk assessments, and monitor mitigation plans.
• Assess cybersecurity risks associated with third parties, outsourced services, cloud environments, and significant technology changes.
• Ensure compliance with SAMA CSF and applicable regulatory requirements and lead cybersecurity maturity assessments and internal and external audits.
• Manage corrective action plans, track audit and regulatory findings, and coordinate regulatory reporting with the Compliance Department.
• Oversee cybersecurity event monitoring, threat detection, vulnerability management, penetration testing, and security operations.
• Approve and lead cybersecurity incident response activities, ensure timely regulatory reporting, and implement lessons learned following incidents.
• Oversee cybersecurity controls across networks, applications, endpoints, identity management, and cloud services.
• Maintain organizational independence from the Information Technology Department, including reporting lines, budget management, and employee performance evaluation.

Job Requirements

• Saudi national.
• Bachelor's degree in Cybersecurity, Computer Science, Computer Engineering, Information Systems, or a related discipline.
• Minimum of 8 years of experience in cybersecurity or information security, including at least 3 years in a leadership or supervisory role.
• Practical knowledge of SAMA CSF, cybersecurity governance, risk management, and regulatory compliance.
• Full-time commitment to the CISO role, without concurrent responsibilities within the Information Technology Department.
• Ability to meet applicable professional suitability and integrity requirements and obtain the required SAMA non-objection approval.

Preferred Qualifications

• Master's degree in Cybersecurity, Information Security, Business Administration, or a related field.
• Professional certifications such as CISSP, CISM, CRISC, CGEIT, or ISO/IEC 27001 Lead Auditor / Lead Implementer.
• Previous experience in a regulated financial institution.
• Relevant professional accreditation from the Saudi Council of Engineers.
• Knowledge of the Saudi Personal Data Protection Law (PDPL) and National Cybersecurity Authority (NCA) controls.

Technical Knowledge

• Governance, Risk, and Compliance (GRC) platforms.
• Security Information and Event Management (SIEM) and Security Operations Centers (SOC).
• Identity and Access Management (IAM) and Privileged Access Management (PAM).
• Endpoint Detection and Response (EDR/XDR) and Data Loss Prevention (DLP).
• Vulnerability management and penetration testing.
• Network, application, API, and cloud security.
• SAMA CSF, ISO/IEC 27001, and NIST Cybersecurity Framework (NIST CSF).

Core Competencies

• Strategic thinking, leadership, team development, and decision-making.
• Strong executive communication and risk reporting skills.
• Crisis management and incident response leadership.
• Analytical thinking and problem-solving.
• Vendor management, negotiation, and stakeholder engagement.
• Integrity, confidentiality, and professional ethics.
• Collaboration with IT, Risk Management, Compliance, Legal, and Internal Audit.

Language Requirements

• Arabic: Full professional proficiency in written and spoken Arabic.
• English: Advanced proficiency in written and spoken English.