Cybersecurity Governance Lead Specialist

The Saudi Tadawul Group was established in March 2021, following the transformation of the Saudi Stock Exchange (Tadawul) into a Holding Group structure. It is the parent company with a portfolio of four subsidiaries, which operate independently while benefitting from the integration and synergies between one another.

The subsidiaries include: The Saudi Exchange, a dedicated stock exchange business, the Securities Clearing Center Company (Muqassa), the Securities Depository Center Company (Edaa) and Wamid, a new innovative applied technology services business, focused on providing innovation and nascent technologies to the capital markets industry through pragmatic innovation.

The Group aims to advance the Saudi capital markets infrastructure in line with global best practices, while reinforcing Saudi Arabia's position as an emerging market leader, a technologically advanced and attractive global investment destination and the gateway to the MENA region.

It looks to support the successful delivery of Saudi Arabia's Financial Sector Development Program (FSDP) objectives, as part of Vision 2030, to boost economic growth and diversify the economy.

Job Description

Principal Duties and Responsibilities

1. Carry out a cybersecurity risk assessment.
2. Recognize patterns of non-compliance with cybersecurity policies and related documentation to identify ways to improve the documentation.
3. Periodically review cybersecurity strategy, policies and related documents to maintain compliance with applicable legislation and regulation.
4. Analyze organization's cybersecurity defense policies and configurations to evaluate compliance with regulations and organizational directives.
5. Carry out vulnerability scanning on systems and assets.
6. Use security testing and code scanning tools to conduct code reviews.
7. Conduct or support authorized penetration testing of infrastructure and assets.
8. Ensure that appropriate technologies are used to maintain compliance with privacy and cybersecurity requirements.
9. Develop or identify awareness training materials that are appropriate for intended audiences.

Key Accountabilities

1. Carry out daily operations assigned for the department to comply with the company’s standards.
2. Prepare timely and accurate department reports to meet the requirements, objectives, and standards of the company and the department.
3. Ensure the satisfaction of internal and external customers to address their needs in a courteous and timely manner.
4. Follow all relevant policies, procedures, and processes in order for the work to be carried out in a controlled and consistent manner.
5. Contribute to the identification of opportunities for continuous improvement of processes and practices, work processes, cost effectiveness, and productivity enhancement.
6. Promote to other employees within the organization the implementation and adherence to policies, procedures, processes, and instructions.
7. Maintain a good and respectful relationship with other colleagues and represent the company in a good image.

Job Specifications

Education and Certifications

• Bachelor's degree in Information Technology, Computer Science, or equivalent is required.
• Master's degree in Information Technology, Computer Science, or equivalent is preferred.
• Certified Information Systems Security Professional (CISSP) certificate or equivalent is preferred.

Knowledge and Experience

• 3+ years of experience in Cybersecurity Governance is required.
• Knowledge of network components, their operation and appropriate network security controls and methods.
• Knowledge and understanding of risk assessment, mitigation and management methods.
• Knowledge of cybersecurity related threats and vulnerabilities.
• Knowledge of the likely operational impact on an organization of cybersecurity breaches.
• Knowledge and understanding of new technologies and solutions from a cybersecurity perspective.
• Knowledge of the cybersecurity regulations and requirements relevant to the Group.
• Knowledge of system administration, network management and operating system hardening methods.
• Knowledge of an organization's cybersecurity data classification requirement.
• Knowledge of penetration testing and red teaming principles, tools and techniques.

Skills Required

• Skill in determining the normal operational state for security systems and how that state is affected by change.
• Skill in developing policies which reflect the organization's business and cybersecurity strategic objectives.
• Skill in evaluating the viability and legitimacy of suppliers and products.
• Skill in negotiating vendor agreements.