S

SSC HR Solutions

Information Security & Cybersecurity Risk Manager

CybersecurityConfirmed live in the last 24 hours
Full-timeCairo, Cairo Governorate, EgyptNo salary listed

About the Job

Requirements

  • A bachelor's degree in Information Technology, Computer Science, Cybersecurity, Information Security, or a related discipline is required.
  • CISSP or CISM certification is mandatory.
  • Eight to ten years of professional experience in information security or cybersecurity is required.
  • At least three years of experience in a cybersecurity or information security management or leadership role is required.
  • Proven experience managing enterprise cybersecurity programs and security teams is required.
  • Proven experience in governance, risk and compliance, risk management, security operations, and incident response is required.
  • Proven experience working with regulatory compliance, audits, and cybersecurity frameworks is required.
  • Strong knowledge of cybersecurity frameworks, standards, and best practices is required.
  • Deep understanding of NCA, PDPL, NDMO, ISO 27001, and applicable data protection requirements is required.
  • Strong expertise in governance, risk, and compliance is required.
  • Experience with security operations centre (SOC) operations and SIEM platforms such as Microsoft Sentinel, Splunk, or equivalent is required.
  • Strong understanding of vulnerability management and penetration testing is required.
  • Strong knowledge of incident response and Cybersecurity Incident Response Plans is required.
  • Strong understanding of identity and access management and access governance is required.
  • Knowledge of data protection, data classification, and data governance is required.
  • Strong understanding of secure architecture and security controls is required.
  • Ability to develop and monitor cybersecurity KPIs and KRIs is required.
  • Strong audit and regulatory assessment experience is required.
  • Ability to assess and communicate cybersecurity risks in terms of business impact is required.
  • Strong strategic thinking and high-level decision-making capability is required.
  • Excellent leadership and people-management skills are required.
  • Ability to manage cross-functional teams and stakeholders under pressure is required.
  • Bilingual proficiency in Arabic and English is required.
  • Ability to work effectively in a fast-paced and dynamic environment is required.
  • Ability to manage cybersecurity incidents and critical security situations is required.
  • Willingness to participate in security incident response and escalation activities when required is required.
  • Strong confidentiality and professional integrity are required.
  • Ability to work collaboratively with executive leadership, IT, business functions, auditors, and regulatory stakeholders is required.

Responsibilities

  • Define, develop, and execute the organization’s information security strategy and cybersecurity roadmap.
  • Own and continuously improve the Information Security Management System (ISMS).
  • Develop and maintain information security policies, standards, procedures, and guidelines.
  • Establish effective cybersecurity governance frameworks aligned with business objectives.
  • Provide regular reporting on cybersecurity posture, risk exposure, compliance, and security program performance to the CTO and executive leadership.
  • Establish and monitor security KPIs, KRIs, and performance metrics.
  • Ensure information security requirements are incorporated into technology initiatives, projects, and business processes.
  • Lead regular information security and cybersecurity risk assessments across the organization.
  • Own and maintain the enterprise IT and cybersecurity risk register.
  • Identify, assess, prioritize, and communicate information security risks.
  • Develop and manage risk treatment plans and ensure remediation activities are tracked through to closure.
  • Work closely with business units, IT, and other stakeholders to establish appropriate risk mitigation strategies.
  • Translate technical cybersecurity risks into business impact and communicate them effectively to senior management.
  • Monitor the organization’s overall cyber risk profile and provide recommendations for risk reduction.
  • Oversee Security Operations Centre activities, including SOC analysts and security engineers.
  • Ensure effective security monitoring, threat detection, investigation, and response capabilities.
  • Oversee SIEM operations and security monitoring platforms such as Microsoft Sentinel, Splunk, or equivalent technologies.
  • Establish and monitor security incident management processes.
  • Review security alerts, incidents, trends, and threat intelligence.
  • Ensure appropriate escalation and response mechanisms are in place for critical security events.
  • Monitor and improve the effectiveness of security controls and operational processes.
  • Lead the organization’s cybersecurity incident response capability.
  • Ensure effective detection, containment, eradication, recovery, and post-incident activities.
  • Develop, maintain, and continuously improve the Cybersecurity Incident Response Plan.
  • Conduct regular incident response exercises and simulations.
  • Lead investigations into significant security incidents and ensure Root Cause Analysis is completed.
  • Track corrective and preventive actions resulting from security incidents.
  • Ensure lessons learned are incorporated into security controls and processes.
  • Lead information security governance, risk, and compliance activities.
  • Ensure compliance with applicable regulatory and industry requirements, including National Cybersecurity Authority requirements, Saudi Personal Data Protection Law, National Data Management Office requirements where applicable, ISO/IEC 27001, and other applicable cybersecurity and data protection regulations.
  • Coordinate internal and external security audits and assessments.
  • Manage audit evidence collection and maintain an organized security evidence repository.
  • Track audit findings, remediation plans, and closure status.
  • Prepare management and regulatory compliance reports.
  • Support regulatory assessments, reviews, and submissions as required.
  • Establish and maintain data protection and information classification frameworks.
  • Ensure appropriate security controls are implemented for sensitive and personal data.
  • Work with relevant stakeholders to support compliance with the Saudi Personal Data Protection Law and applicable data protection requirements.
  • Establish appropriate data access, handling, retention, and protection controls.
  • Support privacy and data protection risk assessments where required.
  • Oversee vulnerability management activities across IT environments.
  • Coordinate vulnerability assessments and penetration testing.
  • Review vulnerability and penetration testing reports.
  • Ensure security vulnerabilities are appropriately prioritized based on business risk.
  • Track remediation activities and validate closure of critical and high-risk vulnerabilities.
  • Ensure security testing is incorporated into relevant technology projects and systems.
  • Establish and maintain identity and access management policies, standards, and access control frameworks.
  • Ensure appropriate access governance and segregation of duties.
  • Review privileged access and high-risk accounts.
  • Support periodic user access reviews and access recertification.
  • Ensure access controls align with business requirements and security policies.
  • Develop and implement an organization-wide security awareness program.
  • Lead cybersecurity awareness campaigns and security training.
  • Implement phishing simulation and social engineering awareness programs.
  • Monitor employee security awareness performance and identify improvement areas.
  • Promote a strong cybersecurity culture across all business functions.
  • Ensure cybersecurity requirements are incorporated into Business Continuity and Disaster Recovery plans.
  • Participate in business continuity and disaster recovery risk assessments and exercises.
  • Ensure critical systems have appropriate security, recovery, and resilience controls.
  • Support testing and continuous improvement of security-related recovery procedures.

Desired Qualifications

  • ISO/IEC 27001 Lead Implementer or Lead Auditor certification is preferred.
  • NCA-related cybersecurity accreditation or certification is preferred.

About the Company

SSC HR Solutions

Company size
Not listed
Company stage
Not listed
Total funding
Not listed
Headquarters
Not listed
Founded
Not listed

Recently Posted Jobs

Explore more opportunities at SSC HR Solutions

See more jobs