security lead

PetroApp

<p></p><div>About PetroApp<p>
PetroApp is building a modern technology platform, helping customers and partners move faster with confident, reliable systems. As we scale our engineering organization, we&rsquo;re investing in both world-class reliability and pragmatic, high-impact security.</p><p></p>
The Role<p>
We&rsquo;re hiring a Security Lead with a strong DevOps/SRE background to build and lead our security practice while remaining hands-on across cloud infrastructure, CI/CD, and production reliability.</p><p>
You&rsquo;ll own the security strategy across the SDLC and production environment, embed security into developer workflows, lead vulnerability management and penetration testing with external vendors, and work closely with our Platform/DevOps/SRE team to ensure PetroApp&rsquo;s systems are both secure and reliable.</p><p></p>
What You&rsquo;ll DoSecurity Leadership &amp; Strategy<ul><li>
Own the overall security roadmap and strategy for PetroApp, aligning it with business and product priorities.</li><li>
Act as the primary security point of contact for engineering and leadership.</li><li>
Define, document, and maintain security policies, standards, and guidelines for engineering teams.</li><li>
Lead risk assessments, threat modeling, and security design reviews for major initiatives.</li><li>
Define and track key security KPIs and report status, risks, and progress to leadership.</li></ul>
DevSecOps &amp; SDLC Security<ul><li>
Embed security into the SDLC by integrating SAST, DAST, dependency and container scanning, and IaC scanning into CI/CD pipelines.</li><li>
Establish secure coding practices and patterns; provide guidance and reviews for high-risk changes.</li><li>
Set up and maintain secrets management and secrets detection across repos and environments.</li><li>
Drive vulnerability management: triage findings, prioritize remediation, track SLAs, and verify fixes.</li><li>
Partner with engineers to ensure security controls are automated and developer-friendly.</li></ul>
Cloud &amp; Platform Security (with SRE Mindset)<ul><li>
Own and continuously improve the cloud and platform security posture (IAM, networking, encryption, key management, hardening).</li><li>
Design and enforce least privilege access models and secure-by-default infrastructure baselines.</li><li>
Ensure security is built into core platform components such as Kubernetes, service-to-service communication, and data stores.</li><li>
Collaborate with SRE/DevOps on secure, resilient architectures, covering scalability, failover, and disaster recovery.</li></ul>
Reliability &amp; Incident Collaboration<ul><li>
Collaborate with SRE/DevOps to maintain high availability and reliability of production systems.</li><li>
Contribute to observability and monitoring with a security lens: actionable alerts, meaningful logging, and traceability.</li><li>
Participate in incident response for security-related events, including root cause analysis and long-term fixes.</li><li>
Help improve on-call and incident processes where security and reliability intersect.</li></ul>
External Security Engagements &amp; Enablement<ul><li>
Own relationships with external security vendors, including penetration testing and security assessments.</li><li>
Scope, coordinate, and manage penetration tests; track findings through to remediation and retesting.</li><li>
Coordinate security-related input for audits, certifications, and customer security questionnaires as needed.</li><li>
Run security awareness and training initiatives tailored to engineers and operational teams.</li></ul><p></p><b><br>
Requirements</b><br>
<br>
What We&rsquo;re Looking For (Must-Have)<ul><li>
5+ years of experience across DevOps/SRE/Platform Engineering and application/infrastructure security, with at least 2&ndash;3 years as a primary security owner or lead.</li><li>
Proven experience leading or owning security in a cloud-native, product-focused company.</li><li>
Strong DevOps/SRE background: operating production workloads, on-call experience, CI/CD ownership, automation, and infrastructure-as-code.</li><li>
Deep understanding of cloud security fundamentals (AWS/GCP): IAM, networking, encryption, logging, monitoring.</li><li>
Hands-on experience integrating security tooling into CI/CD pipelines (SAST, DAST, dependency scanning, container/IaC scanning).</li><li>
Solid Linux and networking fundamentals; comfortable debugging complex production and security issues.</li><li>
Experience with containers and orchestration (Docker/Kubernetes) and securing them in production.</li><li>
Practical knowledge of OWASP Top 10, common attack vectors, and secure coding principles.</li><li>
Experience managing penetration tests and/or security assessments, including scoping, coordination, and remediation follow-up.</li><li>
Excellent communication and stakeholder management skills&mdash;able to influence and drive change without blocking delivery.</li></ul><p></p>
Nice to Have<ul><li>
Experience building or operating within security frameworks/compliance programs (e.g., ISO 27001, SOC 2, PCI) relevant to PetroApp&rsquo;s domain.</li><li>
Exposure to WAF, API security, service mesh security, and zero trust patterns.</li><li>
Experience with SIEM/SOAR, security analytics, and detection engineering concepts.</li><li>
Hands-on involvement in bug bounty programs or coordinated vulnerability disclosure processes.</li><li>
Coding ability in at least one backend language (e.g., Python, Go, Node.js, Java) to build security tooling and automation.</li><li>
Experience mentoring or managing engineers with a focus on security and platform engineering.</li></ul><br>
<b>
Benefits</b><br>
<p></p><ul><li>
You will own and shape the security function in a high-impact, hands-on lead role.</li><li>
You&rsquo;ll work at the intersection of security, reliability, and platform engineering, directly influencing how PetroApp scales.</li><li>
Opportunity to work with a modern tech stack and a team that values pragmatism, automation, and continuous improvement.</li><li>
A culture that cares about doing the right thing for customers and partners, with leadership support for investing in security and reliability.</li></ul></div>

Security Lead

CARVANA

<p></p><div><p><b>Pay Range: $50-$62k annually</b></p>
<p><b>
About Carvana</b></p>
<p>
If you like disrupting the norm and are looking to join a company revolutionizing an industry then you will LOVE what Carvana has done for the car buying experience. Buying a car the old fashioned way sucks and we are working hard to make it NOT suck. I mean, have you seen our vending machine?!</p>
<p>
We are looking for people who are excited to<b> thrive</b> in an environment of impactful change. Team spirit is evident at Carvana and everyday we let our passions and creativity foster innovation. We take big swings, set ambitious goals, and challenge each other to make data- and process-driven decisions in everything we do. Here are a few of our stories! We've been changing the game since 2013, and we're not taking our foot off the gas now. Want more of the story? Check out our background here.</p>
<p><b>
About the team and position</b></p>
<p>
As a Functional Lead, you will be an integral part of the Safe and Secure Team executing programs and processes at our Headquarter facilities to ensure our team members and assets are protected. At our front desks, our Safe &amp; Secure Associates are the face of Carvana to our employees, vendors, and visitors. As a Functional Lead, you'll be the direct supervisor of these Associates which includes supervising their day-to-day activities as a team, providing training and coaching on proper protocols/procedures, and continuously upholding a high level of performance.</p>
<p>
You will be a leader in Safe &amp; Secure and act as a representative of Carvana to both internal and external partners in routine meetings and day-to-day activities. The ideal candidate for this role is passionate about developing and maintaining effective security and safety policies. This role requires the ability to articulate and demonstrate desired behavior, provide timely, effective, and actionable feedback, and to motivate others to balance urgency and quality.</p><br>
<p></p>
<p><b>
What you'll be doing</b></p>
<ul>
<li>Oversee day-to-day activities of assigned team; identify team's strengths and weaknesses; determine areas of opportunity and the appropriate steps to improve.</li>
<li>Identify and evaluate trends, evaluate outcomes, and develop plans to accomplish team tasks and objectives.
</li><li>Engage assigned team, provide appropriate coaching, development and performance management; offer feedback and demonstrate desired skills.
</li><li>Create a work and team environment that inspires positive communication, team cohesion, and adherence to Carvana's Values.</li>
<li>Proactively communicate information to team members, providing clear understanding of expectations, performance measures, and goals.</li>
<li>Prevent and resolve conflict among team members.</li>
<li>Monitor and ensure adherence to systems, policies, procedures, and performance standards.</li>
<li>Maintain staff by recruiting, selecting, orienting, and training employees.</li>
<li>Positively reinforce and monitor progress toward team goals.</li>
<li>Timely and effectively communicate information to other relevant teams and stakeholders.</li>
<li>Support leadership and participate in implementation and execution of team/department initiatives, and strategies.</li>
<li>Escalate significant high risk issues to senior-level management as necessary and provide recommendations to ensure our teams are safe and our business operations are maintained.</li>
<li>Ensure the safety of our associates by monitoring and developing solutions that meet all local, state and federal requirements.</li>
<li>Implement, execute, and directly lead our Incident Management program at our HQ locations.</li>
<li>Plan and Lead the Incident Management Program for the site, focusing on sustainable awareness and effective preparedness. Key facilitator in an emergency situation for the site.</li>
<li>Directly lead the processes related to our Safe &amp; Secure Technology that supports our HQ locations Ensure equipment is properly functioning, that issues are addressed, and that our processes relating to badge access, server room controls, monitoring alerts, and overall health of the program are running like a well oiled machine.</li>
<li>Ensure the team properly records all incidents, ensures system information is accurate and actionable. Complete after action reviews to determine root causes of reported safety incidents and make improvement recommendations to the Manager, Corporate Security.</li>
<li>Implement and monitor visitor and vendor check-in processes, providing regular team member training and coaching.</li>
<li>Implement and conduct risk assessments of our HQ facilities.</li>
<li>Work with the Safe and Secure Operations Center leadership to provide support when business needs require.</li>
<li>Assign work and hold team members accountable to expectations and deliverables.</li>
<li>Ensure the team always has appropriate staffing that meet relevant KPIs and goals.</li>
<li>Be available and onsite during business hours that could occasionally exceed 40 hours in a week.</li>
<li>Occasionally be available outside of traditional business hours, as needed.</li>
<li>Perform other duties as assigned.</li>
</ul>
<p><b>What you should know/have</b></p>
<ul>
<li>High School Diploma or equivalent.</li>
<li>3+ years experience in physical security operations and/or loss prevention.</li>
<li>1+ years experience directly supervising/managing a team.</li>
<li>Demonstrated ability to coach team members to deliver a consistent, top-notch customer service experience.</li>
<li>Experience working closely and communicating effectively with a diverse set of stakeholders in an ever-changing, rapid growth environment with tight deadlines.</li>
<li>Demonstrated ability to take initiative in a constantly-changing work environment while maintaining flexibility and a collaborative attitude.</li>
<li>Excellent verbal and written communication skills.</li>
<li>Able to help create, develop and implement process improvement(s).</li>
<li>Crisis Management Leadership experience.</li>
<li>Valid driver's license and insurable DMV required.</li>
</ul>
<p><b>We'd love it if you also have</b></p>
<ul>
<li>A Bachelor's degree (or higher) from an accredited college or university, ideally in business, criminal justice, crisis management, security operations.</li>
<li>Experience with project management software.</li>
</ul>
<p><b>Proficiency in Microsoft Excel/Google Sheets.</b></p>
<p><b>
What we'll offer in return</b></p>
<ul>
<li>Full-Time Salaried position.</li>
<li>Medical, Dental, and Vision benefits.</li>
<li>401K with company match.</li>
<li>A multitude of perks including student loan payments, discounts on vehicles, benefits for your pets, and much more..</li>
<li>A great wellness program to keep you healthy and happy both physically and mentally.</li>
<li>Access to opportunities to expand your skill set and share your knowledge with others across the organization.</li>
</ul><ul><li>A company culture focused on high performance and bar-raising, with vast opportunity to learn and grow.</li></ul><br>
<p></p>
<p><b>
Other requirements</b></p>
<p>
To be able to do your job at Carvana, there are some basic requirements we want to share with you.</p>
<ul>
<li>Must be able to read, write, speak and understand English.</li></ul><br>
<p></p>
<p>
Of course, we'll make any reasonable accommodations for those with disabilities to perform the essential functions of their jobs.</p><br>
<p></p>
<p><b>
Legal stuff</b></p>
<p>
Hiring is contingent on passing a complete background check. This role is not eligible for visa sponsorship.</p>
<p>
Carvana is an equal employment opportunity employer. All applicants receive consideration for employment without regard to race, color, religion, gender, sexual orientation, gender identity or expression, marital status, national origin, age, mental or physical disability, protected veteran status, or genetic information, or any other basis protected by applicable law. Carvana also prohibits harassment of applicants or employees based on any of these protected categories.</p>
<p>
Please note this job description is not designed to contain a comprehensive listing of activities, duties, or responsibilities that are required of the employee for this job. Duties, responsibilities, and activities may change at any time with or without notice.</p></div><p></p>

Security Lead - 2nd/3rd Shift

MITRE

<div>Why choose between doing meaningful work and having a fulfilling life? At MITRE, you can have both. That's because MITRE people are committed to tackling our nation's toughest challenges&mdash;and we're committed to the long-term well-being of our employees. MITRE is different from most technology companies. We are a not-for-profit corporation chartered to work for the public interest, with no commercial conflicts to influence what we do. The R&amp;D centers we operate for the government create lasting impact in fields as diverse as cybersecurity, healthcare, aviation, defense, and enterprise transformation. We're making a difference every day&mdash;working for a safer, healthier, and more secure nation and world. Our workplace reflects our values. We offer competitive benefits, exceptional professional development opportunities for career growth, and a culture of innovation that embraces adaptability, collaboration, technical excellence, and people in partnership. If this sounds like the choice you want to make, then choose MITRE - and make a difference with us.<p></p><p>
The Critical Infrastructure Protection Department (L561) sits within MITRE&rsquo;s Cyber-Physical Systems Division. L561 delivers innovative solutions by bringing a multidisciplinary approach to sponsor challenges that are critical to national security and public sector missions. Our work involves researching, developing, and applying advanced technologies in protecting national critical infrastructure from non-kinetic threats and ensuring operational resiliency. Focus areas include:</p><ul><li>
Infrastructure Susceptibility Analysis</li><li>
Safety Engineering</li><li>
Critical Infrastructure (CI) Threat Detection and Analytics</li><li>
CI Adversary Emulation</li><li>
Operational Technology (OT) Device Security</li><li>
Cross-Sector Interdependency analysis</li><li>
Civilian Critical Infrastructure Sector Specific Expertise</li></ul><p></p><p><b>
Roles &amp; Responsibilities:</b></p><ul><li>
Apply cyber threat intelligence expertise to assist sponsors or private owner/operators in securing critical infrastructure and performing cyber operations.</li><li>
Guide government sponsors or private owner/operators in building and advancing their cyber threat intelligence capabilities and programs.</li><li>
Track and analyze adversary tactics, techniques, and procedures (TTPs) relevant to industrial control systems (ICS), Operational Technology (OT), and space system OT, impacting critical infrastructure and national security missions.</li><li>
Support cyber threat modeling, risk assessments, and mission impact analyses for critical infrastructure and space systems based on unclassified and classified sources.</li><li>
Fuse multiple intelligence sources to develop products and recommendations for sponsors to support mission assurance and risk-informed decision-making.</li><li>
Monitor and analyze emerging threats, vulnerabilities, and supply chain risks affecting ICS/OT and Space OT technologies.</li><li>
Serve as a subject matter expert (SME) in cyber threat intelligence with a focus on ICS/OT-relevant threats, working closely with OT engineers and domain experts.</li><li>
Brief sponsors and senior leaders on threat trends, risks, and mitigation strategies to enhance mission assurance.</li><li>
Produce and deliver artifacts and strategic briefings that synthesize classified and unclassified reporting into clear, decision-focused insights for senior leaders.</li><li>
Partner with sponsors to identify key intelligence gaps, prioritize collection, and provide feedback to collectors to improve coverage of priority threats.</li><li>
Contribute to thought leadership (e.g., white papers, best practice guides, methodologies) on threat-informed defense, cyber risk assessment, and CTI tradecraft for critical infrastructure.</li></ul><p></p><p><b>
Basic Qualifications:</b></p><ul><li>
Typically requires a minimum of 8 years of related experience with a bachelor&rsquo;s degree; or 6 years and a master&rsquo;s degree; or a PhD with 3 years&rsquo; experience; or equivalent combination of related education and work experience.</li><li>
Degree in Electrical Engineering, Mechanical Engineering, Civil Engineering, Engineering Technology, Computer Science, Cybersecurity, or related technical field; equivalent utility, military, or industrial experience may be considered.</li><li>
Operational experience with electric power utilities.</li><li>
Experience with industrial control systems (ICS), Operational Technology (OT), SCADA, or other control systems used in critical infrastructure or space missions (through professional work, lab projects, or research).</li><li>
Ability to lead discussions, collaborate across different teams and organizations, and brief technical and non-technical stakeholders.</li><li>
Minimum 50% hybrid on-site work required at MITRE or government locations.</li><li>
Must have a TS clearance to be considered.</li><li>
Per the U.S. Government&rsquo;s eligibility requirements, you must be a U.S Citizen to be considered for a security clearance.</li></ul><p></p><p><b>
Preferred Qualifications:
</b></p><ul><li>Deep subject-matter expertise in SCADA network cyber security.</li><li>
Extensive experience securing, assessing, or operating SCADA, ICS, OT, or other control systems in electric utilities or other critical infrastructure environments.</li><li>
Expert knowledge of ICS/OT architectures, industrial protocols, and embedded/control system components (e.g., PLCs, DCS, SCADA, Modbus, DNP3, OPC).</li><li>
Familiarity with cyber threat intelligence, all-source intelligence, and adversary TTPs relevant to OT/ICS/embedded systems. Experience using frameworks such as ATT&amp;CK to inform detection, defense, or risk analysis.</li><li>
Experience translating threat intelligence, vulnerability information, or adversary behavior into security controls, threat-informed defense, risk assessments, or mission assurance activities.</li><li>
Experience supporting government, utility, or other critical infrastructure cyber defense, analysis, or operational security efforts.</li><li>
Demonstrated track record leading analytic or technical efforts, communicating findings effectively to technical and non-technical stakeholders, delivering high-impact products, and building trusted relationships with demanding customers, leaders, or government sponsors.</li><li>
Excellent interpersonal skills, judgment, discretion, and tact.</li><li>
An advanced degree in Electrical Engineering, Mechanical Engineering, Civil Engineering, Engineering Technology, Computer Science, Cybersecurity, or related technical field is a plus.</li><li>
Active SCI Clearance.</li></ul><p></p><p><b>
This requisition requires the candidate to have a minimum of the following clearance(s):</b></p>
Top Secret<p></p><p><b>
This requisition requires the hired candidate to have or obtain, within one year from the date of hire, the following clearance(s):</b></p>
Top Secret/SCI<p></p><p><b>
Salary compensation range and midpoint:</b></p>
$158,800 - $198,500 - $238,200 Annual<p></p><p><b>
Work Location Type:</b></p>
Hybrid<p></p><p>
It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.<br>
<br>
<b>Commitment to Non-Discrimination</b></p><p>
All qualified applicants will receive consideration for employment without regard to disability, status as a protected veteran or any other status protected by applicable federal, state, local or international law.</p><p></p><p>
MITRE intends to maintain a website that is fully accessible to all individuals. If you are unable to search or apply for jobs and would like to request a reasonable accommodation for any part of MITRE&rsquo;s employment process, please email recruitinghelp@mitre.org for general support and collegerecruiting@mitre.org for intern positions. This service is for individuals requiring reasonable accommodation requests. Please note that vendor solicitations will not receive a reply.</p><p></p><p>
Benefits information may be found here.</p><p></p>
Copyright &copy; 1997-2026, The MITRE Corporation. All rights reserved. MITRE is a registered trademark of The MITRE Corporation. Material on this site may be copied and distributed with permission only.</div>

Operational Technology (OT) Systems Security, Lead

Nawy

<div>
 We are seeking an experienced GRC Lead to drive governance, risk, and compliance activities
 <br/>
 <br/>
 in Nawy. This role ensures that security risks are identified, assessed, and managed while
 <br/>
 <br/>
 maintaining compliance with relevant regulatory and industry standards.
 <br/>
 <br/>
 The GRC lead leads the risk governance initiatives, oversees audits, develops policies,
 <br/>
 <br/>
 manages security awareness, and partners closely with engineering, product, and legal teams
 <br/>
 <br/>
 to ensure secure-by-design operations across the entire organization.
 <br/>
 <br/>
 <strong>
  Responsibilities
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   Maintain an enterprise-wide information security governance &amp; ISMS framework that
   <br/>
   <br/>
  </li>
 </ul>
 aligns with business objectives, regulatory requirements, and industry best practices.
 <br/>
 <br/>
 <ul>
  <li>
   Develop, maintain, and enforce security policies, standards, and procedures
  </li>
  <li>
   Lead strategic planning initiatives for security risk management, ensuring alignment
   <br/>
   <br/>
  </li>
 </ul>
 with ISO 27001 requirements.
 <br/>
 <br/>
 <ul>
  <li>
   Design, implement, and manage a security risk management framework that includes
   <br/>
   <br/>
  </li>
 </ul>
 risk assessments, control evaluations, and mitigation strategies.
 <br/>
 <br/>
 <ul>
  <li>
   Oversee and continuously improve the processes for vendor security risk assessments,
   <br/>
   <br/>
  </li>
 </ul>
 ensuring third-party risks are effectively managed.
 <br/>
 <br/>
 <ul>
  <li>
   Develop and monitor key risk indicators (KRIs) and performance metrics to evaluate the
   <br/>
   <br/>
  </li>
 </ul>
 effectiveness of security controls and risk mitigation efforts.
 <br/>
 <br/>
 <ul>
  <li>
   Oversee the development, implementation, and ongoing management of the
   <br/>
   <br/>
  </li>
 </ul>
 organization's security policies.
 <br/>
 <br/>
 <ul>
  <li>
   Prepare and lead the organization's readiness for external and internal security audits,
   <br/>
   <br/>
  </li>
 </ul>
 including ISO 27001 certification audits.
 <br/>
 <br/>
 <ul>
  <li>
   Build and run security awareness and phishing simulation programs and promote an
   <br/>
   <br/>
  </li>
 </ul>
 organization-wide culture of security accountability.
 <br/>
 <br/>
 <ul>
  <li>
   Ensure ongoing compliance with local regulatory frameworks, including those issued by
   <br/>
   <br/>
  </li>
 </ul>
 CBE, FRA, and related bodies.
 <br/>
 <br/>
 <strong>
  Requirements
  <br/>
  <br/>
 </strong>
 <ul>
  <li>
   At least 4 years of experience in GRC, information security risk management or security
   <br/>
   <br/>
  </li>
 </ul>
 compliance roles.
 <br/>
 <br/>
 <ul>
  <li>
   Certifications: Relevant certifications such as CISSP, CISM, CRISC, or CISA are
   <br/>
   <br/>
  </li>
 </ul>
 preferred.
 <br/>
 <br/>
 <ul>
  <li>
   Demonstrated experience with ISO 27001 implementation, security audits, and vendor
   <br/>
   <br/>
  </li>
 </ul>
 security risk assessments.
 <br/>
 <br/>
 <ul>
  <li>
   Solid understanding of cloud architectures and security controls across AWS and
   <br/>
   <br/>
  </li>
 </ul>
 Google Cloud Platform (GCP).
 <br/>
 <br/>
 <ul>
  <li>
   Familiarity with regulatory requirements in Egypt and international data protection
   <br/>
   <br/>
  </li>
 </ul>
 laws.
 <br/>
 <br/>
 <ul>
  <li>
   University/college degree in a relevant professional field
  </li>
  <li>
   Excellent communication skills in English, both written and spoken
  </li>
 </ul>
</div>


Cyber Security GRC Lead

Nawy Real Estate

<div><p>We are seeking an experienced GRC Lead to drive governance, risk, and compliance activities</p><p>
in Nawy. This role ensures that security risks are identified, assessed, and managed while</p><p>
maintaining compliance with relevant regulatory and industry standards.</p><p>
The GRC lead leads the risk governance initiatives, oversees audits, develops policies,</p><p>
manages security awareness, and partners closely with engineering, product, and legal teams</p><p>
to ensure secure-by-design operations across the entire organization.</p><p>
Responsibilities</p><ul><li>Maintain an enterprise-wide information security governance &amp; ISMS framework that</li></ul><p>
aligns with business objectives, regulatory requirements, and industry best practices.</p><ul><li>Develop, maintain, and enforce security policies, standards, and procedures.</li><li>Lead strategic planning initiatives for security risk management, ensuring alignment</li></ul><p>
with ISO 27001 requirements.</p><ul><li>Design, implement, and manage a security risk management framework that includes</li></ul><p>
risk assessments, control evaluations, and mitigation strategies.</p><ul><li>Oversee and continuously improve the processes for vendor security risk assessments,</li></ul><p>
ensuring third-party risks are effectively managed.</p><ul><li>Develop and monitor key risk indicators (KRIs) and performance metrics to evaluate the</li></ul><p>
effectiveness of security controls and risk mitigation efforts.</p><ul><li>Oversee the development, implementation, and ongoing management of the</li></ul><p>
organization&rsquo;s security policies.</p><ul><li>Prepare and lead the organization&rsquo;s readiness for external and internal security audits,</li></ul><p>
including ISO 27001 certification audits.</p><ul><li>Build and run security awareness and phishing simulation programs and promote an</li></ul><p>
organization-wide culture of security accountability.</p><ul><li>Ensure ongoing compliance with local regulatory frameworks, including those issued by</li></ul><p>
CBE, FRA, and related bodies.</p><b><br>
Requirements</b><p></p><ul><li><br>
At least 4 years of experience in GRC, information security risk management or security</li></ul><p>
compliance roles.</p><ul><li>Certifications: Relevant certifications such as CISSP, CISM, CRISC, or CISA are</li></ul><p>
preferred.</p><ul><li>Demonstrated experience with ISO 27001 implementation, security audits, and vendor</li></ul><p>
security risk assessments.</p><ul><li>Solid understanding of cloud architectures and security controls across AWS and</li></ul><p>
Google Cloud Platform (GCP).</p><ul><li>Familiarity with regulatory requirements in Egypt and international data protection</li></ul><p>
laws.</p><ul><li>University/college degree in a relevant professional field.</li><li>Excellent communication skills in English, both written and spoken.</li></ul></div>

Dragonfli Group LLC

<div><p><b>About Dragonfli Group</b></p><p>
Dragonfli Group is an elite cybersecurity and IT advisory firm specializing in security operations, architecture, governance, and technology implementation for enterprise and regulated industry clients. We are a certified small business with deep experience across federal, financial services, utilities, and professional services sectors.</p><p></p><p><b><br>
Overview</b></p><p><b>
Location:</b> Washington, DC or Boston, MA or Dayton, OH preferred;</p><p>
Dragonfli Group is seeking an Information Security Compliance Lead for a high-stakes, client-facing engagement. This is a pure-play GRC role supporting an active information security program within a premier client environment. The successful candidate will act as a primary lead for the GRC function, requiring deep compliance execution experience, exceptional professional presence, and the ability to operate with total autonomy from day one. The right candidate will be able to manage audit cycles and platform implementations immediately.</p><p></p><p><b><br>
Responsibilities:</b></p><ul><li>
Independently complete complex client security questionnaires and audit responses using established firm precedent and maintain organized submission records.
</li><li>Lead compliance monitoring and enforcement against ISO 27001 and ISO 42001 (AI Management System).
</li><li>Directly manage the 30-day implementation and optimization of the Vanta trust center platform.
</li><li>Conduct and document risk assessments, policy reviews, and audit evidence gathering for an upcoming audit window.
</li><li>Develop and maintain cybersecurity policies and procedures aligned to regulatory requirements and AI/ML-enabled monitoring.
</li><li>Deliver and track compliance training and awareness initiatives; report outcomes to leadership.
</li><li>Interface directly with client legal, compliance, and IT stakeholders as a polished representative of the firm.</li></ul><br>
Requirements:<br>
<br>
<p><b>Minimum Qualifications</b></p><ul><li>
2-5+ years supporting information security in large, complex environments (Law firm or Big 4 experience strongly preferred).
</li><li>Expert-level working knowledge of ISO 27001 and NIST CSF.
</li><li>Proven experience implementing or managing Vanta or equivalent trust center platforms.
</li><li>Exceptional written and interpersonal communication skills; ability to produce &quot;client-ready&quot; deliverables without internal oversight.
</li><li>Bachelor's degree in computer science, information security, or related field; equivalent experience considered.
</li><li>Preferred certifications: CISSP, CISA, or CompTIA Security+</li></ul><br>
Skill(s):
<br>
<ul><li>GRC platform expertise (Vanta, OneTrust, Archer, or ServiceNow GRC).
</li><li>Security questionnaire automation tools (Whistic, Responsive, Loopio).
</li><li>Third-party risk management (TPRM) fundamentals and SOC 2 Type I/II audit support. GDPR, CCPA, and AI privacy regulation familiarity.
</li><li>Evidence collection, audit artifact management, and policy lifecycle management.
</li><li>Risk register development and maintenance.
</li><li>Business continuity and disaster recovery documentation support.
</li><li>Strong proficiency in Microsoft 365 (SharePoint, Teams, Word, Excel) for collaboration.
</li><li>Experience working in a ticketing or GRC workflow environment (Jira, ServiceNow).</li></ul></div>

Information Security Compliance Lead

<div><div><div><div>All locations
</div></div><div><ul><li>Al Khobar, Saudi Arabia</li>
<li>Jeddah, Saudi Arabia</li>
</ul></div><div><div>Business:</div>
<div>Business Assurance</div>
</div><div><div>Position type:</div>
<div>Full Time</div>
</div><div><div>Contract type:</div>
<div>Permanent Employee</div>
</div><div><div>Job ID:</div>
<div>6598</div></div></div></div>
<br><div><div><div><div><div><h2 class="jobSectionHeader"><b>Benefits</b></h2>
<p>Please note, benefits may depend on your contract type, please confirm with your recruiter.</p>
<div><div><div><div><div><div><h3 class="jobSectionHeader"><b>Profit Share</b></h3>
</div><p>You&rsquo;ll be part of our global profit share scheme that means we all share in our success as a business. If we profit, so do you. This will be part of our Total Compensation approach each year and depends on our year-end results.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Insurance</b></h3>
</div><p>Taking care of you with travel, life, and accident insurance.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Pension Schemes</b></h3>
</div><p>We care about your long-term financial security and prioritize pension and retirement benefits to reflect our caring values.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Professional Development</b></h3>
</div><p>We believe in the 70/20/10 learning model, where 70% of your learning comes from performing your everyday tasks and working on different projects, new areas and initiatives to gain new skills. 20% from working with others and mentoring and the rest from formal education.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Hybrid Working</b></h3>
</div><p>Adapting to the changing world of work around the world.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Purpose-led organization</b></h3>
</div><p>You become part of a world-leading company where we know and live our purpose; to safeguard life, property, and the environment, with the opportunity to tackle global change through your work.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Supportive and caring culture</b></h3>
</div><p>We offer opportunities to connect through social and professional networks. Our largest community CONNECT, organizes after-work events and informal meetings throughout the year.</p>
</div></div><div><div><div><h3 class="jobSectionHeader"><b>Attractive rewards</b></h3>
</div><p>We focus on work/life balance and offer employees flexible working hours and workplace, annual vacation allowance, competitive pension, insurance, and a global profit share scheme.</p><br>
</div></div></div></div></div></div></div></div></div><p></p><div><div><div><div><h2 class="jobSectionHeader"><b>Diversity, Equity and Inclusion</b></h2>
<div><p>At DNV, our commitment to Diversity, Equity, and Inclusion is not only an ethical choice, but also a business decision.</p>
</div><div></div><p>Diversity, fairness, and a sense of belonging are a source of strength for our people, our business, and our customers, and help us to deliver on our purpose, vision, and values.</p><br>
 </div></div></div></div><div></div><div><div><div><div><div><div><div>Transcript
</div></div><div><div><div><p>Business Assurance is a unit of DNV where we are working with our customers towards verifying them if they are compliant with some particular rules. We are responsible for scheduling audits. We need to assign the right person with the right competences to conduct such an audit. And we are analysing and improving their processes. But sometimes we need to register some findings like observation, opportunity for improvement, or even non-conformities. I verify our clients' system management by observing them, how they work, how they produce. It's very interesting because we are delivering some additional information for our customers, what they cannot see or discover in their own systems. My work life as an auditor is completely different than employees who are working from the office every day. Because usually I'm travelling to our customers that are located in a different part of our country. Almost every week I work with different people in different companies. So if you like travel, if you are well organized, DNV can be for you.</p>
</div></div></div></div></div></div></div></div><div></div><div><div><div><div><h2 class="jobSectionHeader"><b>Working here</b></h2>
<div><p>Since 1864 we&rsquo;ve been dedicated to safeguarding life, property and the environment. Today we remain at the forefront of new technologies and techniques to help our customers transform for a more sustainable future.</p>
</div><div></div><p>At DNV you can expect to deliver career and industry defining work. You&rsquo;ll be given the time to build your network, the resources to support your development, and the freedom to satisfy your curiosity and desire to learn.</p></div></div></div></div></div>

Information security Lead Auditor (Kingdom of Saudi Arabia)

Search 10000+ Security lead jobs near you this May. New roles added regularly across leading industries. Apply today.

10000 security lead jobs Near Me

Security Lead

Security Lead - 2nd/3rd Shift

Operational Technology (OT) Systems Security, Lead

Cyber Security GRC Lead

Cyber Security GRC Lead

Information Security Compliance Lead

Information security Lead Auditor (Kingdom of Saudi Arabia)