cybersecurity risk manager

Omada Rail Systems

<div><ul><li>Permanent Contract
</li></ul><ul><li>Mid-Senior Level
</li></ul><ul><li>Doha
</li></ul><ul><li>Consultancy</li></ul></div>
 <div>About Us 
Egis is a leading global architectural, consulting, construction engineering, operations and mobility services firm. We create and operate intelligent infrastructure and buildings that both respond to the climate emergency and contribute to balanced, sustainable and resilient development. Our 20,500 employees operate across over 100 countries, deploying their expertise to develop and deliver cutting-edge innovations and solutions for clients. Through the wide range of our activities, we are central to the collective organisation of society and the living environment of citizens all over the world.&quot;
With 3,500 employees across 8 countries in the Middle East, Egis has delivered over 700 complex development projects, stimulating economic growth and enhancing quality of life. Ranked among the top ten firms in the Middle East by Engineering News Record (ENR), Egis is committed to sustainable development. The Group&rsquo;s operations in the Middle East are built on strategic acquisitions and a deep understanding of local market conditions. Egis&rsquo; long history of providing comprehensive engineering, consulting, and project management services makes it a trusted partner for regional governments, investors, and developers. 
About the Role 
We are seeking a highly skilled Cybersecurity Governance (GRC) Manager to join our Roads Operations and Maintenance (O&amp;M) team in Doha, Qatar. In this critical role, you will be responsible for developing, implementing, and maintaining our cybersecurity governance framework, ensuring the protection of our road infrastructure and related systems.<ul><li>
Develop and oversee the implementation of cybersecurity policies, procedures, and standards aligned with industry best practices and regulatory requirements</li><li>
Conduct regular risk assessments and audits to identify vulnerabilities in our road operations and maintenance systems</li><li>
Collaborate with cross-functional teams to integrate cybersecurity measures into our operational technology (OT) environments</li><li>
Manage the organization's compliance with relevant cybersecurity regulations and standards in the transportation sector</li><li>
Lead the development and execution of cybersecurity awareness programs for staff involved in roads O&amp;M</li><li>
Establish and maintain a robust incident response plan for potential cybersecurity threats to road infrastructure</li><li>
Provide regular reports and updates to senior management on the organization's cybersecurity posture and risk landscape</li><li>
Stay informed about emerging cybersecurity threats and trends in critical infrastructure protection</li></ul> 
What do we need from you 
<ul><li>
Bachelor's degree in Computer Science, Information Security, or a related field; Master's degree preferred</li><li>
Minimum of 5 years of experience in cybersecurity governance, risk management, and compliance</li><li>
Strong knowledge of GRC frameworks such as NIST, ISO 27001, and COBIT</li><li>
Demonstrated experience with cybersecurity in operational technology (OT) environments</li><li>
Proficiency in risk assessment and management methodologies</li><li>
Excellent communication, leadership, and project management skills</li><li>
In-depth knowledge of relevant regulations and standards in the transportation sector</li><li>
CISSP, CISM, or other relevant cybersecurity certifications strongly preferred</li><li>
Experience in the transportation or infrastructure sector is a plus</li><li>
Familiarity with ICS/SCADA systems security</li><li>
Expertise in cybersecurity for critical infrastructure and roads operations and maintenance</li><li>
Strong understanding of Governance, Risk, and Compliance (GRC) frameworks and their application in a complex operational environment</li><li>
Ability to work effectively in a multicultural environment and adapt to the local context in Doha, Qatar</li></ul> 
What's in it for you?</div>

Cybersecurity Governance (GRC) Manager (Roads O&M)

بنك التعمير والإسكان HD Bank

<div>
 
 
 
 
 Job Summary:
 
 
 
 
 
 
 
 
 The
 
 IT Risk Management Unit Manager
 
 is responsible for
 
 identifying, assessing, mitigating, and monitoring IT-related risks
 
 within the organization. This role ensures that the bank's IT systems, infrastructure, and operations comply with
 
 risk management frameworks, regulatory requirements, and cybersecurity best practices
 
 to safeguard the organization from potential threats.
 
 
 
 
 
 
 
 Job Responsibilities:
 
 
 
 
 
 
 
 <ul>
 <li>
 Develop and enforce IT asset management policies and procedures.
 </li>
 <li>
 Conduct risk assessments to identify cybersecurity threats, operational vulnerabilities, and compliance gaps.
 </li>
 <li>
 Evaluate IT systems, applications, and processes to determine risk exposure and impact.
 </li>
 <li>
 Develop and maintain an IT risk register, tracking identified risks and their mitigation measures.
 </li>
 <li>
 Develop and implement IT risk management strategies and frameworks to minimize operational risks.
 </li>
 <li>
 Recommend security controls, technology enhancements, and process improvements to reduce IT risk exposure.
 </li>
 <li>
 Ensure disaster recovery (DR) and business continuity (BCP) plans are in place and tested regularly.
 </li>
 <li>
 Ensure IT risk management practices align with regulatory standards (e.g., GDPR, PCI DSS, ISO 27001, NIST, COBIT).
 </li>
 <li>
 Collaborate with internal and external auditors to address compliance requirements and risk assessments.
 </li>
 <li>
 Stay updated on IT risk regulatory changes and ensure necessary adjustments to risk management policies.
 </li>
 <li>
 Develop and oversee the IT incident response plan, ensuring swift and effective resolution of IT security incidents.
 </li>
 <li>
 Work with IT security teams to analyze and report security breaches, cyber threats, and system failures.
 </li>
 <li>
 Conduct post-incident evaluations to identify root causes and implement preventive measures.
 </li>
 <li>
 Work closely with senior IT leaders, cybersecurity teams, compliance officers, and risk managers to integrate IT risk management into business operations.
 </li>
 <li>
 Provide risk advisory and training to IT and business teams to enhance risk awareness.
 </li>
 <li>
 Act as the primary liaison for regulatory bodies, auditors, and external service providers regarding IT risk-related matters.
 </li>
 <li>
 Prepare and present IT risk reports, risk dashboards, and compliance updates to senior management and regulatory authorities.
 </li>
 <li>
 Maintain comprehensive documentation of risk management policies, procedures, and assessments.
 </li>
 <li>
 Conduct periodic risk reviews and IT audits to ensure alignment with best practices.
 </li>
 </ul>
 
 
 
 
 
 
 
 Job Qualifications:
 
 
 
 
 
 
 
 <ul>
 <li>
 Bachelor's degree in Information Technology, Computer Science, Business Administration, or a related field.
 </li>
 <li>
 
 Minimum 8+ years
 
 of experience in
 
 IT risk management, cybersecurity, or IT governance
 
 .
 </li>
 <li>
 Strong background in
 
 IT compliance, security frameworks, and enterprise risk management
 
 .
 </li>
 <li>
 Experience in
 
 managing IT risk programs, conducting IT risk assessments, and collaborating with auditors
 
 .
 </li>
 </ul>
 
 
</div>

IT Risk Management Unit Manager

Rivian

<div><div>The Cybersecurity Analyst &ndash; Risk Management is a mid-career individual contributor supporting Rivian&rsquo;s cybersecurity risk management practice. This role involves day-to-day management of cybersecurity risks, monitoring key risk indicators (KRIs), and facilitating risk discussions with technology and business stakeholders.</div><div></div><div> 
The analyst will leverage Rivian&rsquo;s risk platforms and AI-enabled tooling to improve efficiency, transparency, and defensibility of risk decisions. This role sits within Enterprise Cybersecurity on the Cybersecurity Risk Management team and partners closely with the Cyber Third-Party Risk Management (TPRM) lead, security engineering teams, and other functions.</div> 
<ul><li>
Risk Register Ownership: Maintain and continuously improve the cybersecurity and crown-jewel risk registers, ensuring risks are clearly defined, scored, prioritized, and kept current.</li><li>
Track risk status from identification through treatment and closure, including documenting decisions, owners, due dates, dependencies, and evidence.</li><li>
Design, implement, and monitor KRIs and related metrics, such as control health, incident trends, and assessment throughput, to provide an objective view of risk posture.</li><li>
Meet regularly with risk owners and functional leaders to gather updates, validate assumptions, and align on risk treatment plans and progress.</li><li>
Evaluate how risks propagate across systems, suppliers, processes, and programs; surface second-order and cascading impacts in risk narratives and dashboards.</li><li>
Collaborate with the Cyber TPRM lead where responsibilities intersect, including supplier-driven risks, concentration risk, and systemic control gaps, to ensure consistent risk assessment and treatment.</li><li>
Help facilitate workshops and review sessions with business and technology leaders to clarify risk scenarios, tradeoffs, and treatment options.</li><li>
Use Rivian&rsquo;s risk platform and AI-enabled tools to improve efficiency, effectiveness, and expediency in risk logging, analysis, reporting, and communication.</li><li>
Maintain and evolve a Cybersecurity Risk Dashboard that provides an accurate, near real-time view of key risks, KRIs, and trends for leadership and governance forums.</li><li>
Apply NIST CSF and ISO 27001 concepts when assessing controls, documenting risks, and proposing treatments, helping ensure consistency with the ISMS and enterprise risk practices.</li><li>
Identify gaps and friction in current risk processes and propose practical improvements to increase clarity, adoption, and impact.</li></ul><div> 
Minimum Qualifications</div><ul><li>
5+ years of combined experience in cybersecurity, technology risk, enterprise risk management, or related fields.</li><li>
At least 3 years with primary responsibility for leading or owning a risk management function, program, or risk domain within an organization.</li><li>
Hands-on experience maintaining and operating risk registers and risk management tooling, including GRC, IRM, or dedicated risk platforms.</li><li>
Working knowledge of the NIST Cybersecurity Framework (CSF) and exposure to frameworks such as ISO/IEC 27001, including risk assessment/treatment concepts and control alignment.</li><li>
Demonstrated ability to influence risk treatment decisions, not just document them, by framing options, tradeoffs, and business impact for stakeholders.</li><li>
Strong analytical and quantitative risk skills, including building KRIs, basic risk modeling, scenario comparison, and trend analysis.</li><li>
High comfort working with AI tools for analysis, synthesis, workflow automation, and responsible experimentation to improve risk processes.</li><li>
Excellent written and verbal communication skills with the ability to translate complex technical risks into concise, business-relevant narratives.</li><li>
Proven ability to work cross-functionally, build trust with stakeholders, and facilitate productive discussions in ambiguous situations.</li></ul><div>
Preferred Qualifications</div><ul><li>
Experience with modern GRC/IRM or dedicated risk platforms and building risk dashboards for security leadership.</li><li>
Professional certifications such as CRISC, PMI-RMP, CISM, or similar.</li><li>
Experience in fast-paced, high-growth environments such as technology, automotive, or manufacturing, where speed, agility, and rigor are required.</li></ul></div>

Staff Cybersecurity Analyst, Risk Management

TERREPOWER (formerly BBB Industries)

<div>
 
 Job Description
 
 
 
 
 Position Summary
 
 
 
 The Manager, Cyber Security Systems and Controls is responsible for leading the strategy, design, and execution of cybersecurity systems, controls, and risk management across a global, multi country environment. This role requires direct international cybersecurity experience, including securing systems across regions, navigating country specific regulations, and addressing cross border cyber risks.
 
 
 The ideal candidate is a proactive problem solver who can identify vulnerabilities, perform root cause analysis, and drive cybersecurity solutions from discovery through resolution in complex, international operating environments.
 
 
 
 Responsibilities
 
 
 
 <ul>
 <li>
 Develop, implement, and maintain a scalable global cybersecurity strategy aligned with business objectives and international regulatory requirements.
 </li>
 <li>
 Lead cybersecurity operations and governance across international locations, ensuring consistent standards while addressing regional risks and operational differences.
 </li>
 <li>
 Apply and enforce cybersecurity frameworks including ISO 27001, NIST, and other relevant global standards across all regions.
 </li>
 <li>
 Ensure secure cross‑border data flows and protection of systems supporting international manufacturing and distribution operations.
 </li>
 <li>
 Proactively identify cybersecurity risks, vulnerabilities, and control gaps within global systems and processes.
 </li>
 <li>
 Lead root‑cause investigations for security incidents, audit findings, compliance gaps, and infrastructure weaknesses.
 </li>
 <li>
 Own remediation efforts from identification through execution, validation, and long‑term sustainability.
 </li>
 <li>
 Ensure problems are fully resolved&mdash;not temporarily mitigated&mdash;and that lessons learned are incorporated into standards and processes.
 </li>
 <li>
 Partner with infrastructure, applications, and business teams to embed security controls into daily operations and IT projects.
 </li>
 <li>
 Review network and infrastructure environments (LAN, WAN, SD‑WAN, MPLS, VPNs, firewalls, cloud and on‑prem systems) from a cybersecurity and resiliency perspective.
 </li>
 <li>
 Lead and support disaster recovery and business continuity planning, testing, and readiness across global locations.
 </li>
 <li>
 Drive continuous improvement initiatives focused on reducing risk, improving detection and response, and strengthening overall security posture.
 </li>
 <li>
 Work closely with international IT teams, leadership, and external partners to identify risks and align remediation strategies.
 </li>
 <li>
 Establish and manage a global supplier cybersecurity assessment program, including risk evaluation, remediation tracking, and acceptance criteria.
 </li>
 <li>
 Lead responses to customer, regulatory, and third‑party security audits, ensuring timely, thorough resolution of findings.
 
 
 </li>
 </ul>
 
 Education and Minimum Qualification
 
 
 
 <ul>
 <li>
 Bachelor&rsquo;s degree in computer science, Information Technology, or a related field; equivalent professional experience may be considered.
 </li>
 <li>
 Professional cybersecurity certifications such as CISSP, CISA, GIAC, or demonstrated progress toward one or more of these credentials strongly preferred.
 </li>
 <li>
 Minimum of 8 years of progressive IT management experience, with increasing responsibility across cybersecurity, infrastructure, or enterprise IT functions.
 </li>
 <li>
 Proven experience developing and enforcing cybersecurity policies and designing security architectures for multi‑site environments; experience supporting organizations with a global footprint is strongly preferred.
 </li>
 <li>
 Broad technical background across multiple infrastructure domains, including servers, networks, endpoints, cybersecurity controls, and both on‑premises and cloud environments.
 </li>
 <li>
 Strong, hands‑on technical expertise with enterprise infrastructure solutions, including MPLS networks, SD‑WAN, firewalls, and secure remote access technologies.
 </li>
 <li>
 Working knowledge of ITIL frameworks and formal project management methodologies, with the ability to apply structured processes to real‑world operations.
 
 
 </li>
 </ul>
 
 About Us
 
 
 
 
 About Us:
 
 
 
 For over 35 years, TERREPOWER (formerly BBB Industries) has been a leader in sustainable manufacturing, driving the circular economy by extending the life of essential products in the automotive and industrial markets.
 
 
 Founded in 1987 in Daphne, Alabama by the Bigler family, TERREPOWER began as a small regional remanufacturer of starters and alternators. Our commitment to quality and innovation quickly earned us a reputation as a trusted name in the automotive industry.
 
 
 Recognizing new challenges and opportunities, in 2019 we set our sights on EV battery upcycling-addressing one of the industry&rsquo;s most pressing issues. Our engineering team pioneered solutions to extend EV battery life, pushing the boundaries of sustainable innovation.
 
 
 Recognizing that demand for solar panels would exceed availability and 100,000 tons of waste would potentially go into landfills by 2035, our team searched for an innovative way to upcycle solar panels. With an eye on the future, we developed ways to upcycle solar panels.
 
 
 Rooted in family and community values, we&rsquo;re proud to have second-generation employees contributing to our legacy. Backed by Clearlake Capital, we&rsquo;ve expanded our footprint into Europe with facilities in Spain, Italy, Denmark, Germany and Poland. We now sustainably manufacture and supply an assortment of nondiscretionary repair parts across more than 90 countries.
 
 
 As we move forward under the TERREPOWER name, we remain committed to the same values that have always defined us: entrepreneurship, teamwork, customer-centered, sustainability, safety.
 
 
 
 Why Join Us?
 
 
 
 When you join our team, you become part of a company that is redefining how essential products are made, reused and repurposed to reduce waste and maximize resources.
 
 
 
 Here&rsquo;s What Sets Us Apart
 
 
 
 <ul>
 <li>
 Purpose-Driven Work &ndash; Every day, your work will contribute to extending the useful life of essential products, keeping vehicles on the road and critical systems running.
 </li>
 <li>
 Innovative Mindset &ndash; We encourage creative problem-solving and bold ideas to push the boundaries of what is possible.
 </li>
 <li>
 Global Reach, Local Impact &ndash; With operations in North America and Europe, we have a global presence but remain deeply connected to the communities we serve.
 </li>
 <li>
 Growth &amp; Development &ndash; Whether you&rsquo;re on the production floor, in engineering, or part of our corporate team, we invest in your success through training, mentorship, and career advancement opportunities.
 </li>
 <li>
 A Culture of Collaboration &ndash; Rooted in teamwork and shared values, our employees work together to tackle challenges and drive meaningful change.
 
 
 </li>
 </ul>
 TERREPOWER is an Equal Opportunity Employer. We are committed to fostering an inclusive, diverse, and equitable workplace. We welcome applicants of all backgrounds and do not discriminate on the basis of race, color, sex, pregnancy, age, veteran status, religion, national origin, genetic information, disability unrelated to the ability to perform a job, sexual orientation, or transgender status to the extent protected by law. We believe that diversity drives innovation and success.
</div>

Manager, Cyber Security Systems and Controls

MITRE

<div>Why choose between doing meaningful work and having a fulfilling life? At MITRE, you can have both. That's because MITRE people are committed to tackling our nation's toughest challenges&mdash;and we're committed to the long-term well-being of our employees. MITRE is different from most technology companies. We are a not-for-profit corporation chartered to work for the public interest, with no commercial conflicts to influence what we do. The R&amp;D centers we operate for the government create lasting impact in fields as diverse as cybersecurity, healthcare, aviation, defense, and enterprise transformation. We're making a difference every day&mdash;working for a safer, healthier, and more secure nation and world. Our workplace reflects our values. We offer competitive benefits, exceptional professional development opportunities for career growth, and a culture of innovation that embraces adaptability, collaboration, technical excellence, and people in partnership. If this sounds like the choice you want to make, then choose MITRE - and make a difference with us.
The Cyber Solutions Innovation Center creates solutions using threat-informed cybersecurity approaches to enhance the security, safety, and resiliency of critical cyber systems and infrastructure.
The Cyber Assessments and Security Automation department serves as MITRE&rsquo;s resource for cyber risk evaluation and security innovation. Our team is dedicated to advancing the field of cybersecurity by combining deep expertise in risk assessment with cutting-edge automation technologies. This dual focus enables us to address the evolving needs of our sponsors, ensuring scalable and effective cybersecurity solutions that meet today&rsquo;s challenges and anticipate tomorrow&rsquo;s threats.
Our work is defined by innovation, exemplified through initiatives like SAF, ECHO, and ACT, which demonstrate our commitment to developing transformative tools and methodologies. By leveraging automation, we empower organizations to enhance their security posture efficiently and effectively, positioning them to stay ahead in an increasingly complex cyber landscape.
The Cyber Assessments and Security Automation department reflects MITRE&rsquo;s leadership in cybersecurity, making our value clear to sponsors and internal stakeholders alike. We don&rsquo;t just assess risks; we innovate solutions that drive the future of cybersecurity.
The Cyber Assessments and Security Automation department within the Cyber Solutions Innovation Center is seeking a Principal level Cybersecurity Assessment Engineer to lead the department&rsquo;s contributions across our portfolios. The department supports all of MITRE by providing a variety of cyber assessment products plus overall cyber engineering skills. The Principal Cybersecurity Assessment Engineer position will be a core member of the department and government technical team and serve as the first-line support for various sponsors. The position requires direct contributions to our diverse work programs.
Roles &amp; Responsibilities:<ul><li>
Expertise conducting cybersecurity assessments and workshops for government agencies.</li><li>
Define the Security‑Automation Blueprint for sponsor programs.</li><li>
Design and implement Reusable Automation Frameworks that integrate with existing security tools (Nessus, Burp Suite, Qualys, Tenable.io, Splunk, QRadar, eMASS).</li><li>
Develop and implement security strategies, and provide mentorship to junior assessors.</li><li>
Cybersecurity Risk Management: Expert knowledge of cybersecurity risk management frameworks and methodologies.</li><li>
Vulnerability Assessment &amp; Penetration Testing: Conduct vulnerability assessments, penetration testing, and ethical hacking of applications and systems to identify and remediate security weaknesses.</li><li>
Security Controls Assessment: Conduct Security Controls Assessments (SCA), workshops, and audits for internal teams and partner organizations.</li><li>
Security Tools Utilization: Utilize a variety of security tools&mdash;including Burp Suite, Nessus, Splunk, QRadar, WireShark, eMASS, and others&mdash;to support security operations and assessments.</li><li>
Collaborate effectively with MITRE, government, and contractors; effectively communicate in writing, presentations, and collaborative discussions; and interface with peers, managers, and sponsors.</li><li>
Promote collaboration and integration with other organizational elements within the department and across MITRE.</li></ul>
Basic Qualifications:<ul><li>
Requires a minimum of 10 years of related experience with a Bachelor&rsquo;s degree; or 8 years and a Master&rsquo;s degree; or a PhD with 5 years&rsquo; experience; or equivalent combination of related education and work experience.</li><li>
Automation &ndash; Ansible, Terraform, CloudFormation, Chef, Puppet, SaltStack.</li><li>
CI/CD &ndash; GitHub Actions, GitLab CI, Azure DevOps, Jenkins.</li><li>
Familiarity with Windows, Linux, macOS/Open BSD, and VxWorks/Tornado operating systems.</li><li>
Proficiency in programming languages including Java, C#, C++, Python, Perl, Visual Basic, ASP.NET, PHP, COBOL.</li><li>
Experience in software engineering and systems engineering, including requirements analysis and technical writing.</li><li>
Certifications: CISSP, Certified Ethical Hacker (CEH), Network+, AWS Certified Cloud Practitioner.</li><li>
This position requires a minimum of 50% hybrid on-site</li><li>
Must be able to successfully obtain a Top-Secret clearance within one year of hire
</li><li>Per the U.S. Government&rsquo;s eligibility requirements, you must be a U.S Citizen to be considered for a security clearance</li></ul>
Preferred Qualifications:<ul><li>
Graduate-level degree in a technical discipline (Cybersecurity, Information Assurance, etc.).</li><li>
15 years related experience as a cybersecurity analyst/systems engineer.</li><li>
Active Top Secret Security Clearance.</li><li>
Experience with advanced assessment techniques utilizing Kali Linux, Burp Suite, Wireshark, etc.</li><li>
Experience with various Security Information and Event Management (SIEM) platforms (Splunk, QRadar, Tenable products, etc.)</li><li>
Experience with offensive and defensive cybersecurity operations, including penetration testing</li><li>
Experience with various Information Technology (IT) operations in enterprise environments including system integration, device/network hardening, server administration, network maintenance, etc.</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
GIAC Penetration Tester (GPEN), GIAC Certified Intrusion Analyst (GCIA)</li><li>
CompTIA Security+, CompTIA Network+, CompTIA Linux+</li></ul>
This requisition requires the candidate to have a minimum of the following clearance(s):
Top Secret
This requisition requires the hired candidate to have or obtain, within one year from the date of hire, the following clearance(s):
None
Salary compensation range and midpoint:
$172,800 - $216,000 - $259,200 Annual
Work Location Type:
Hybrid
Commitment to Non-Discrimination
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local or international law.
MITRE intends to maintain a website that is fully accessible to all individuals. If you are unable to search or apply for jobs and would like to request a reasonable accommodation for any part of MITRE&rsquo;s employment process, please email recruitinghelp@mitre.org for general support and collegerecruiting@mitre.org for intern positions. This service is for individuals requiring reasonable accommodation requests. Please note that vendor solicitations will not receive a reply.
Benefits information may be found here.
Copyright &copy; 1997-2026, The MITRE Corporation. All rights reserved. MITRE is a registered trademark of The MITRE Corporation. Material on this site may be copied and distributed with permission only.</div>

Principal Cybersecurity Assessment Engineer

Riyadh Air

<div>About the Company:

Riyadh Air (RX), headquartered in the Saudi Capital, is the new national airline that&rsquo;s shaping the future of flying. It seeks to lead the aviation industry by transforming Saudi Arabia into a global aviation and trade hub &ndash; a digitally native airline that will connect the kingdom to more than 100 destinations.
About the Role:

Do you have the technical depth and leadership drive to strengthen cybersecurity resilience for a next‑generation global airline? 
We&rsquo;re looking for a highly skilled individual to lead Riyadh Air&rsquo;s cybersecurity assurance and offensive security capabilities by proactively identifying, validating, and reducing cyber risk across the organisation. 
In this role, you&rsquo;ll lead vulnerability assessments, penetration testing, red team operations, and threat modelling across network, application, cloud, and infrastructure environments. 
You&rsquo;ll work closely with SOC, DFIR, technology, and engineering teams to embed security into system design, delivery pipelines, and operational processes. 
In addition, you'll be both strategic and hands‑on, equally comfortable leading programmes and deep‑diving into technical assessments. 
Importantly, you will turn technical findings into action by driving remediation, improving detection capabilities, enforcing security requirements within SDLC and CI/CD pipelines, and ensuring assurance activities meet regulatory and industry standards. 
Join us in shaping a secure foundation for the future of air travel; where proactive defence meets innovation, and trust is built by design.
About You:

Degree qualified, you are expected to demonstrate 7+ years of relevant experience in offensive security, penetration testing, or cybersecurity assurance, with a deep understanding of threat modelling, vulnerability management, and secure SDLC practices. 
We&rsquo;d love to hear from you even more if you have a strong track record in offensive security, cybersecurity assurance, and technical risk management, ideally within large, regulated or complex environments. 
This is your opportunity to help protect and shape the future of air travel. Bring your expertise and show us why you can own this position within Riyadh Air. 
Please submit your application by clicking on the Apply button. Our Talent Acquisition team will be reviewing applications shortly.</div>

Cybersecurity Assurance Manager

Stellar Hunters

<div><h4 class="jobSectionHeader">Job Summary</h4>
We are seeking a Cyber GRC Manager to lead and mature the company&rsquo;s cyber governance, risk, and compliance (GRC) program. The successful candidate will partner with Security, IT, Legal, Risk, and business stakeholders to design, implement, and operate controls, policies, and risk management practices that reduce cyber risk and support business objectives. This role will own compliance initiatives, third-party risk assessments, policy lifecycle management, and metrics to drive continuous improvement across the organization.<h4 class="jobSectionHeader">
Key Responsibilities</h4><h5 class="jobSectionHeader">
GRC Strategy &amp; Program Leadership</h5><ul><li>
Develop and evolve a risk-based cyber GRC strategy that aligns with enterprise risk appetite and business priorities.</li><li>
Lead the GRC program, including governance forums, risk assessment cadence, control frameworks, and remediation tracking.</li><li>
Partner with senior leadership to translate regulatory and business requirements into practical program objectives and roadmaps.</li></ul><h5 class="jobSectionHeader">
Policy, Standards &amp; Control Management</h5><ul><li>
Maintain and enhance information security policies, standards, and procedures; ensure clear ownership and version control across the policy lifecycle.</li><li>
Define and maintain control objectives mapped to frameworks (e.g., NIST CSF, ISO 27001, SOC 2) and ensure consistent implementation across teams.</li><li>
Coordinate control testing, assessments, and remediation activities with internal teams and external assessors.</li></ul><h5 class="jobSectionHeader">
Risk Assessment &amp; Third-Party Risk Management</h5><ul><li>
Conduct enterprise and technology risk assessments; identify, evaluate, and prioritize cyber risks and mitigation plans.</li><li>
Own third-party risk management processes including vendor risk assessments, due diligence, contract security requirements, and ongoing monitoring.</li><li>
Work with procurement and vendor owners to remediate deficiencies and reduce supply chain risk.</li></ul><h5 class="jobSectionHeader">
Compliance &amp; Audit Support</h5><ul><li>
Manage compliance programs and readiness for relevant regulations and standards (e.g., SOC 2, ISO 27001, GDPR, HIPAA where applicable).</li><li>
Act as primary liaison for internal and external audits, prepare evidence and reporting, and coordinate remediation activities.</li><li>
Maintain documentation and continuous evidence of controls to support attestations and regulatory reporting.</li></ul><h5 class="jobSectionHeader">
Metrics, Reporting &amp; Continuous Improvement</h5><ul><li>
Define and report GRC metrics and dashboards (e.g., risk posture, control maturity, remediation timelines, vendor risk status) to leadership and stakeholders.</li><li>
Use data and trend analysis to identify program gaps, recommend improvements, and measure the effectiveness of risk reduction efforts.</li><li>
Develop and maintain GRC playbooks, runbooks, and process documentation to enable repeatable, auditable practices.</li></ul><h4 class="jobSectionHeader">
Required Qualifications - Skills &amp; Experience</h4><ul><li>
Bachelor&rsquo;s degree in Information Security, Cybersecurity, IT, Risk Management, or a related field, or equivalent practical experience.</li><li>
5+ years of hands-on experience in cyber governance, risk, and compliance, information security, or related roles.</li><li>
Practical knowledge of common security frameworks and standards (e.g., NIST CSF, ISO 27001, SOC 2) and experience mapping controls to frameworks.</li><li>
Experience managing third-party/vendor risk assessments, contract security requirements, and remediation workflows.</li><li>
Strong communication and stakeholder management skills with the ability to influence technical and non-technical audiences.</li><li>
Analytical mindset with experience developing risk assessments, metrics, and executive-level reporting.</li><li>
Familiarity with GRC platforms, risk assessment tools, ticketing systems, and common productivity software.</li></ul><h4 class="jobSectionHeader">
Preferred Qualifications</h4><ul><li>
Relevant certifications such as CISSP, CISM, CRISC, CISA, or CDPSE preferred.</li><li>
Experience supporting SOC 2, ISO 27001, or other third-party audits and working with external assessors.</li><li>
Background in cloud security, identity and access management, or secure software development lifecycle practices.</li><li>
Experience implementing or operating GRC tooling (e.g., Archer, RiskLens, OneTrust, ServiceNow GRC) is a plus.</li></ul><h4 class="jobSectionHeader">
Work Environment &amp; Compensation</h4><ul><li>
Full-time position with a hybrid onsite/remote model; occasional travel and after-hours engagement may be required to support assessments and incident response activities.</li><li>
Competitive salary commensurate with experience and a comprehensive benefits package, including health insurance, retirement plan options, and paid time off.</li><li>
Opportunities for professional development, cross-functional collaboration, and career growth within Security, IT, and Risk functions.</li><li>
Inclusive, respectful culture that values diversity, equity, and work-life balance.</li></ul></div>

Cyber GRC Manager

Search 10000+ Cybersecurity risk manager jobs near you this May. New roles added regularly across leading industries. Apply today.