Job description

SAMA CSF, PDPL, NCA ECC and PCI-DSS all fall within scope for this Information Security Specialist (GRC) role at Tabby, where governance, risk and compliance activities get executed independently across the information security programme. You maintain and update the information security governance framework documentation, policy library, and associated standards and procedures. Policies, standards and baselines get drafted and revised to stay aligned with regulatory requirements and business objectives, while changes in legal, regulatory and contractual requirements get tracked through the compliance register. Information security risk assessments get executed independently, producing complete risk registers with identified threats, vulnerabilities, likelihood, impact and treatment plans. The information asset register stays current, tracking asset owners, classifications and associated risk profiles, and business impact assessment data gets collected in coordination with asset owners and business units. Control effectiveness evaluations get conducted for key information security controls, with findings documented and gaps escalated for treatment. Third-party information security risk assessments get coordinated, from preparing questionnaires through reviewing vendor responses and producing risk summaries. Compliance posture against SAMA CSF, NCA ECC, PDPL, ISO 27001 and PCI-DSS gets monitored continuously, with internal and external audit activities coordinated alongside remediation tracking. Security awareness programmes, KPI and KRI dashboards, and GRC subject matter support across business and technology teams round out the role.