Job description

NCA Essential Cybersecurity Controls and SAMA CSF requirements sit at the centre of this Head of Cybersecurity role, covering the overall security posture for BytePlus and Volcano Engine's cloud services in Saudi Arabia. IaaS, PaaS and SaaS all fall under this remit, since the Cybersecurity team owns security across every layer of the cloud platform. You'll provide independent executive leadership across cybersecurity governance, risk management and security operations, reporting risk in line with the organization's appetite and regulatory expectations. Governance work spans clear ownership, segregation of duties and advising executive management on cybersecurity risks, threats and control effectiveness. Risk management and compliance sit under this role too, from owning the cybersecurity risk framework to acting as the primary point of accountability with regulators. Security operations get overseen end to end, covering monitoring, detection, vulnerability management, IAM and incident response, with security by design built into infrastructure, applications, cloud and data platforms. Incident management runs through executive coordination during material cybersecurity incidents, aligned with business continuity and disaster recovery planning. You're expected to bring 5 or more years of experience in security strategy, cybersecurity governance or risk management, with familiarity across OWASP, ISO 27001, PCI DSS, NIST and SAMA or NCA frameworks. Third party cybersecurity risk, vendor compliance and talent development in line with Saudization all round out the scope, alongside defining policy and escalating risk to executive management.