Role Summary:
Leading the cybersecurity and privacy program for SAFE. This role will involve developing and implementing security and privacy policies and procedures, managing security and privacy incidents, and ensuring compliance with relevant regulations and standards.
Main Responsibilities:
- Develop and implement cybersecurity and privacy programs that align with business objectives and industry best practices.
- Manage and oversee SAFE security and privacy incident response program, including incident reporting, investigation, and resolution.
- Conduct risk assessments and vulnerability assessments to identify potential security and privacy risks and develop mitigation strategies.
- Develop and implement security and privacy policies and procedures, including data protection policies, access controls, and incident response plans.
- Stay up to date on emerging cybersecurity and privacy threats and trends and develop strategies to address them.
- Manage relationships with external vendors and partners to ensure compliance with security and privacy requirements.
- Provide guidance and support to employees on security and privacy issues, including training and awareness.
- Monitor and report on key cybersecurity and privacy metrics, including vulnerability assessments, security incidents, and compliance status.
- Ensure compliance with relevant security and privacy regulations and standards such as CITC, NCA, SAMA, SDAIA.
- Perform additional tasks as assigned.
Managerial Accountability:
Human Capital Development
- Create strategy, goals or plans for the team as appropriate, in alignment with SAFE goals.
- Set priorities and manage workload for self and staff.
- Recognize training needs and ensure that staff gain needed skills.
- Create strategy, goals or plans for the team as appropriate, in alignment with SAFE goals.
Required Qualifications:
- Minimum bachelor’s degree, Cybersecurity, Computer Science, Information Technology, or a related field.
- 10+ years of experience in various roles, including at least 3 years in a leadership role.
- CISSP, CISM, or CISA, are a plus.
Leadership Competency:
Driving Success:
- Translates SAFE vision and goals into clear, specific and achievable objectives. Takes control of projects, leading on key tasks and monitoring others to ensure they fulfil their roles effectively.
- Demonstrates belief in and personal commitment to SAFE vision and mission. Fulfils commitments while maintaining high levels of productivity and output for self and team.
Building Relationships:
- Builds an understanding of who key stakeholders are (including shareholders), their needs, drivers and constraints. Develop common understanding across widely competing needs.
- Interacts well with others, quickly establishing rapport and maintaining useful relationships with internal and external stakeholders for the benefit of the organization.
Engaging Individuals:
- Creates a team identity and shared purpose among team members. Articulates the vision for the future in a way to motivate others to action. Finds effective ways to empower individuals and help them succeed.
- Focuses on developing, coaching and mentoring talent to enhance skills, knowledge and abilities to improve individual and organizational performance.
Core Competency:
Dependability:
- Self-driven and acts proactively.
- Pursues goals with persistence and stamina, works on tasks thoroughly, ensuring accuracy and meeting standards.
- Maintains high levels of quality and effectiveness of work outputs and achieves outstanding results.
Collaboration:
- Collaborates constructively with people at all levels across the organization.
- Helps colleagues, always available to the team, and delivers on team commitments.
- Trusts the guidance and direction of colleagues and senior members of the team.
Analytical Thinking:
- Examines evaluates and analyses different types of information objectively.
- Spots trends and patterns, establishes key facts clearly and interprets numerical data effectively.
- Provides insights and identifies ways to improve things. Trusts your intuition about which methods will work best.
Effective Communication:
- Listens attentively and seeks to understand before being understood.
- Explains things clearly, articulates and presents information effectively and confidently.
- Challenges ideas effectively and presents persuasive arguments by presenting a strong case.
Functional Competency:
Threat Analysis
Knowledge of structure, approach, and strategy of exploitation tools (e.g., sniffers, keyloggers) and techniques (e.g., gaining backdoor access, collecting/exfiltrating data, conducting vulnerability analysis of other systems in the network). Skill in the deep analysis of captured malicious code (e.g., malware forensics).
Vulnerability Assessment
Ability to identify systemic security issues based on the analysis of vulnerability and configuration data.
Data Privacy and Protection
Demonstrates knowledge of data privacy and protection infrastructure, standards, and procedures and engages with stakeholders to raise organizational data privacy and protection capability and awareness.
Incident Management
Demonstrates knowledge of incident categories, incident responses, and timelines for responses.
Cyber Risk Management
Demonstrates knowledge of information technology (IT) supply chain security and supply chain risk management policies, requirements, and procedures to identify relevant threats and vulnerabilities, assess the potential threat’s impact, and develop mitigation plans.
Cyber Security Strategy & Governance
Leverage understanding of cybersecurity regulatory requirements, industry standards, and the national cybersecurity strategy to develop and enhance the SAFE cybersecurity strategy, governance model, and controls and ensure robust threat monitoring and incident management policies and procedures are in place.
Cyber Security Audit & Compliance
Ability to conduct security compliance audits to verify that information processes meet the security criteria (requirements or policy, standards, and procedures).
Data Analysis
Demonstrates knowledge of analytic tools and techniques for Network traffic, system artifacts, and infrastructure logs.