Summary
Echelon is hiring a security and reliability leader based in Riyadh, reporting to the Managing Director and travelling to customer sites across Saudi Arabia. The role owns security engineering, cloud and data security, incident response, resilience, disaster recovery, business continuity, and the company’s trust and compliance programme. The successful candidate will bring 10 or more years of security experience, hands-on cloud and data security expertise, and experience building a security programme or leading audits. Arabic and English are required; the package includes a base salary, allowances, medical cover, and equity, with terms shared at offer stage.
The posting
As published on echelon.inc. Pulled from the employer's site and shown as they wrote it.
The Role: Trust in What We Run
Trust, reliability and security start with you. You build an organisation where security, reliability and compliance are the default path. You own Echelon’s environment and the standards that everyone building in it works to, and you build the function around you as the company grows, across both our internal operations and our customer engagements.
What You Will Own
Environment ownership: Echelon owns its cloud accounts, identity, keys and source code. Everyone who builds in the environment, internal or external, works under Echelon’s access controls, and a clean separation path exists for any partner.
Security: Security engineering, application and cloud security, identity and access, detection and response, and vulnerability management.
Resilience & reliability: Incident management, disaster recovery and business continuity. You define the availability, recovery and observability standards our engineers and partners build to, and verify they are met.
Trust & compliance: Governance, security, and privacy compliance, anchored primarily in Saudi regulatory standards (PDPL, NCA ECC-2:2024, NDMO data residency regulations, and SDAIA guidelines). GDPR serves as our global baseline for privacy, with SOC 2 implemented strictly on a customer-demand basis. Encompasses audit readiness, enterprise risk management, third-party risk oversight, and customer trust assurance.
Data & secure channels: Where Echelon’s own data and customer data live: classification, segregation, encryption and retention across the whole environment, and secure file exchange and communication channels for sensitive information, internally and with customers.
Regulator & customer liaison: The named Echelon contact for NCA and for SDAIA/NDMO. Security questionnaires, contractual security and residency clauses, and our customer-facing trust posture.
Key Responsibilities
Strategy & leadership: Define and own a multi-year strategy and roadmap, built for scale, across infrastructure, security, resilience and trust, tied to business goals. Lead this agenda internally and externally. Act as the accountable executive for security and availability, reporting risk posture and progress to the executive team and the board. Report to the Managing Director and work closely with the Chief Operating Officer. Sit on the Crisis Management Team and lead the technical and data-protection workstream in any incident. Build the certifications and policies that make Echelon known, internally and externally, as a highly reliable and highly trusted organisation for our employees, partners and customers, operating to the highest security standards.
Security: Lead a security programme built on zero-trust principles, covering cloud, application, identity, data and endpoint security across the corporate environment and the products and systems built by our engineers, our partners and our customers. Embed security into the software lifecycle: shift-left, secure by default and supply-chain security. Own threat detection, incident response and vulnerability management, including security for AI and LLM-powered features, and AI data governance: AI data-use rules, KSA residency for AI processing and approval of AI use cases. Build the systems and processes that prevent incidents and read signals of weakness early.
Resilience & reliability: Define the availability, recovery and observability standards our engineers and partners build and verify they are met. Own disaster recovery and business continuity plans, with regular tested exercises. Lead the response to major incidents and communicate clearly with customers and leadership.
Trust & compliance: Achieve and maintain the certifications and regulatory compliance our markets require: NCA ECC-2:2024, PDPL and NDMO residency first, with ISO 27001 as the international anchor. Run audits, customer security reviews and a public trust centre, and own the responsible disclosure process and the security [ ]. Own enterprise risk management: the risk framework, risk register and risk appetite, with regular reporting to leadership. Manage third-party and vendor risk, and partner with Legal on privacy and data protection.
AI and Technology First
Security experience: You have 10+ years in security, hands-on in cloud and data security, with at least one build from zero: the first security hire, or taking a company through its first NCA ECC or ISO 27001 audit.
Cloud depth: You can read, challenge and verify architecture, infrastructure as code and data flows built by others, on a major cloud (AWS, GCP or Azure).
Programmes & audits: A track record of building security programmes and leading certification or regulatory audits (NCA ECC, PDPL, ISO 27001), with direct experience of Saudi regulators.
Incidents & continuity: Experience owning major incident response, disaster recovery and business continuity.
Executive communication: You communicate clearly with executives, boards, customers and regulators, and turn technical risk into business decisions.
Influence without authority: You lead and influence virtual teams, holding engineers, partners and customers to security and data standards through clear requirements, review and testing, without direct authority over them.
Builder’s mindset: You favour automation, paved roads and enablement over gatekeeping.
Arabic & English: You work in Arabic and English, and are credible in front of a ministry procurement officer, a regulator and a founder.
Strong Advantage
Regulated sectors: Experience in a regulated sector such as fintech, healthtech or government technology.
Global data protection: Knowledge of international data-protection rules in the markets we serve, such as GDPR.
AI security: Experience securing AI and machine-learning systems and LLM-powered products.
Multi-cloud & hybrid: Multi-cloud or hybrid (cloud plus on-premises) experience, including in-Kingdom hosting and sovereign cloud options.
Certification: Relevant certifications such as CISSP, CISM or cloud architect credentials.
Our Values
Customer first: You measure your work by customer outcomes, and prioritise accordingly.
Ownership mentality: You own outcomes end to end. When something breaks or stalls, you treat it as yours to fix.
Clear communicator: You explain complex systems simply, to operators and executives alike, and make the value of your work visible.
Comfortable with ambiguity: You make progress with incomplete information, partial data and unfamiliar environments, and you enjoy solving problems where there is no structure yet.
Long-term builder: You invest in Echelon’s long-term success, bringing field insight back into our strategy and operations.
Builds others: You measure yourself by the people you develop and the capability you build with customers.
The Seat
Location: Riyadh, Saudi Arabia
Reports to: The Managing Director
Travel: Time on customer sites across the Kingdom.
Package: A base salary with housing, transport and education allowances, medical cover, and equity through the employee equity programme. Terms are shared at offer stage.
How We Work
You start from the problem, not the tool. You meet an unclear brief or a broken environment with energy and a plan.
Curiosity: You learn how the work really happens on site and keep learning as the stack moves.
Speed: You move from brief to a first working result quickly and do not wait for perfect conditions.
Rigour: You test claims against the data, check what is delivered and can explain every choice.
Confidence & humility: You challenge and accept challenges, and change your view on evidence, without ego.
Autonomy: You decide with incomplete information and own it; from an outcome, you organise the work yourself.
Resourcefulness: Missing access, partial data, an unfamiliar organisation: you find a way with what is available.
Situational leadership: You lead when the moment calls for it, and follow when someone else has the better call.
A force multiplier: Your playbooks, reviews and coaching make the whole bench faster.
AI-native depth: AI tools are part of how you work, and you understand how AI systems fail and how they are attacked.
Where you are: A security leader as comfortable in a customer’s security review as in our own crisis room.