Qiddiya Investment Company
Associate Director - Cybersecurity Risk and Compliance
🇸🇦 Riyadh, Saudi Arabia🏢 On-site
CybersecurityRisk AssessmentOT SecurityComplianceSCADAIT SecurityGovernance
At a Glance
- Category
- 💻 Technology
- Level
- C-Level
- Type
- Full-time
Stop — Check First
- Check your CV before Qiddiya Investment Company passes on it
- Get every weak line rewritten
- Download a CV written for the Gulf
Free check in 60 seconds. Fixes $5.88 one-time, only if you want them.
- Roles and Responsibilities:
- Conduct periodic and ad hoc cybersecurity risk assessments across IT and OT environments
- Perform OT-specific risk assessments on assets such as PLCs, HMIs, RTUs, and engineering systems
- Identify and document OT-relevant risk scenarios (e.g., control system disruption, unauthorized access, safety manipulation)
- Coordinate risk reviews as part of major IT/OT changes, such as system upgrades or new deployments
- Reassess risk posture following major changes, incidents, or regulatory updates
- Review and validate existing controls to calculate residual risk and prioritize treatment actions
- Provide standardized tools and guidance to support self-assessments by IT, OT, and business teams
- Support integration of assessment outcomes into control design, zoning, segmentation, and system deployment
- Track risk treatment progress and escalate overdue or high-priority items as needed
- Coordinate with performance management to define and monitor key risk indicators (KRIs) to proactively track changes in cybersecurity risk exposure
- Maintain the cybersecurity risk register, including OT-specific entries, capturing identified risks, likelihood and impact ratings, treatment plans, ownership, and status
- Coordinate and execute internal cybersecurity compliance assessments across all relevant domains and functions
- Serve as the lead interface for external audits and regulatory inspections, including preparation, execution, and response
- Conduct periodic compliance assessments of OT environments, including SCADA, DCS, PLCs, and associated network infrastructure
- Maintain an inventory of compliance-relevant OT assets and map them to applicable control requirements and standards
- Monitor adherence to cybersecurity policies, escalate non-compliance, and coordinate corrective actions with relevant teams
- Track and manage remediation plans for compliance gaps, non-conformities, and audit findings through closure
- Validate the effectiveness of implemented controls or mitigation plans before closing compliance gaps
- Review and validate configuration baselines for OT systems (e.g., firewall rules, firmware versions) to ensure alignment with compliance standards
- Coordinate evidence collection, documentation, and remediation planning for compliance-related findings
- Report OT and IT cybersecurity compliance status and risks to leadership and cybersecurity governance
- Support compliance awareness and training for teams with control responsibilities in both IT and OT
- Maintain a centralized compliance register, covering both IT and OT, that maps regulatory requirements to policies, controls, responsible teams, and evidence sources
- Govern third-party cybersecurity risk by maintaining standardized assessment processes, due diligence criteria, and remediation tracking
- Coordinate and conduct third-party cybersecurity assessments across IT and OT suppliers to ensure alignment with internal policies and regulatory requirements
- Review vendor-supplied OT systems and supporting documentation to ensure inclusion of security controls and compliance with applicable standards (e.g., NCA OTCC, IEC 62443)
- Ensure third-party risk findings are documented, risk-rated, and tracked through resolution, including acceptance or application of compensating controls
- Maintain a register of assessed vendors, associated risks, control gaps, and remediation status for ongoing oversight and reporting
- Collaborate with procurement, legal, and compliance to embed cybersecurity requirements into third-party agreements, including OT-specific clauses where applicable
- Contribute to the development and review of third-party security policy and minimum control requirements for use in procurement and onboarding
- Support internal and external audit requests related to third-party cybersecurity risk management
- Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field.
- Master's degree is preferred.
- 10–12+ years of cybersecurity experience.
- Strong experience in cybersecurity risk management, compliance, assessments, and assurance.
Requirements
- •Experience in conducting periodic and ad hoc cybersecurity risk assessments
- •Knowledge of OT-specific assets (PLCs, HMIs, RTUs, engineering systems)
- •Ability to identify OT-relevant risk scenarios like control system disruption
- •Experience in validating controls to calculate residual risk
- •Ability to coordinate with performance management for Key Risk Indicators (KRIs)
- •Experience in managing internal cybersecurity compliance assessments
- •Experience serving as a lead interface for external audits and regulatory inspections
- •Experience in third-party cybersecurity risk governance
Responsibilities
- •Conduct risk assessments across IT and OT environments
- •Coordinate risk reviews for major system upgrades or new deployments
- •Provide standardized tools and guidance for self-assessments
- •Maintain the cybersecurity risk register including OT-specific entries
- •Execute internal cybersecurity compliance assessments across all domains
- •Monitor adherence to cybersecurity policies and escalate non-compliance
- •Track and manage remediation plans for compliance gaps and audit findings
- •Govern third-party cybersecurity risk and conduct supplier assessments
Related Jobs4 similar jobs
Senior Full-Stack Developer - Remote - 3 Months Contract - Octopus by RTG
robusta · 🇦🇪 UAE
Network Security, Senior Engineer
Master-Works · 🇸🇦 Riyadh
Vulnerability Assessment and Penetration Testing, Senior Engineer
Master-Works · 🇸🇦 Riyadh
Associate Business Systems Analyst (Saudi Arabia)
Eram Talent · 🇸🇦 Dhahran
Browse Similar
Stop — Check First
- Check your CV before Qiddiya Investment Company passes on it
- Get every weak line rewritten
- Download a CV written for the Gulf
Free check in 60 seconds. Fixes $5.88 one-time, only if you want them.
GCC Info
Company
Qiddiya Investment Company
250-1000 employees
Qiddiya is a transformative entertainment, sports, and arts destination located in Riyadh, Saudi Arabia. It aims to be a key driver of economic diversification and a hub for youth development.