About SiFi and the Role

SiFi is a rapidly expanding B2B FinTech company specializing in spend management and card issuance solutions. Based in Riyadh, Saudi Arabia, SiFi helps companies streamline expense workflows and enhance operational efficiency. The Cybersecurity GRC Specialist is a full-time role critical to maintaining SiFi’s cybersecurity compliance posture and ensuring audit readiness across all regulatory frameworks. This position manages the full Governance, Risk, and Compliance (GRC) lifecycle, including evidence management, policy governance, risk tracking, and KPI/KRI reporting, to ensure cybersecurity controls are measurable, defensible, and aligned with regulatory expectations.

Key Responsibilities

• Regulatory Compliance & Audit Readiness: Maintain and manage the compliance tracker across SAMA CSF, PDPL/NDMO, and PCI-DSS. Own the full evidence lifecycle, including collection, validation, and documentation. Ensure continuous audit readiness with traceable, control-aligned evidence. Track regulatory findings and remediation plans, ensuring timely closure, and provide regular compliance status reports to the CISO and relevant committees.
• Governance & Policy Management: Develop and maintain cybersecurity policies, standards, and procedures. Ensure documentation aligns with SiFi governance structure and regulatory expectations. Manage the document lifecycle, including versioning, approvals, and reviews, and map all policies and procedures to SAMA CSF controls.
• Cyber Risk Management: Maintain and update the cybersecurity risk register. Conduct third-party risk assessments (TPRA) and vendor due diligence. Support risk reviews and reporting cycles, and collaborate with Risk and Compliance teams to align enterprise risk frameworks.
• KPI / KRI Monitoring & Reporting: Collect and validate cybersecurity KPIs/KRIs from relevant stakeholders. Maintain a centralized KPI/KRI tracker. Prepare periodic reports with trend analysis to support regulatory maturity (Level 3+), and identify and escalate performance gaps.

Required Experience and Skills

• Minimum of 2 years of dedicated experience in a Cybersecurity GRC role.
• Hands-on experience with SAMA CSF compliance within regulated entities.
• Proven experience in audit evidence preparation and regulatory assessments.
• Strong background in drafting cybersecurity policies and procedures.
• Experience using GRC platforms such as Archer, ServiceNow GRC, or OneTrust.
• Proficiency in both English and Arabic.

Education and Professional Certifications

• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, or a related field.
• Relevant certifications such as ISO 27001 Lead Implementer / Lead Auditor, Security+, (ISC)2 CC, CGRC, CISA, or CRISC.

Desired Qualifications

• Experience with PDPL and NDMO regulations.
• Exposure to PCI-DSS compliance.
• Knowledge of cloud security platforms (AWS, Azure, GCP, OCI).
• Experience within the fintech or financial services industry.
• Familiarity with frameworks like ISO 27001, NIST, and COBIT.

Application Information

This full-time position is based in Riyadh, Saudi Arabia. Qualified candidates are invited to apply.