Cyber Security GRC Consultant (100% Remote)

• 100% Remote Office Work.

• Work on high-visibility compliance and security projects across Saudi Arabia

• Support for certifications and continuous professional development

• Competitive salary and benefits package

Role Summary

We are looking for a Cyber Security GRC Consultant who combines governance and compliance expertise with hands-on technical skills in penetration testing and vulnerability assessment. You will lead compliance engagements from gap assessment to audit readiness. You will also validate controls technically and produce clear, audit-ready documentation and reports for both executive and technical readers.

This role suits someone who writes as well as they hack: able to turn a complex finding or control requirement into a precise, defensible document.

Key Responsibilities

Compliance consulting and delivery

• Lead and deliver PCI DSS (v4.0.x) engagements: scoping, CDE identification, network segmentation review, gap assessment, remediation roadmaps, and readiness for QSA assessment, SAQ or ROC.
• Implement and assess compliance with ISO/IEC 27001:2022, including risk assessment, Statement of Applicability, internal audits and certification readiness.
• Perform gap assessments and implementation support against NCA ECC, Aramco CCC (Third-Party Cybersecurity Standard) and the SAMA Cyber Security Framework, and cross-map controls across frameworks to avoid duplicated effort.
• Support clients through external audits, certification and regulator assessments.

Governance, risk and documentation

• Develop and review policies, standards, procedures, risk registers, asset inventories, incident response plans, BCP/DR documentation and evidence repositories.
• Run risk assessments and maintain treatment plans aligned to client business context.
• Build compliance matrices, control mappings, dashboards and management reports.

Technical security assessment

• Conduct or technically oversee vulnerability assessments (network, systems, cloud, applications) and penetration tests (internal, external, web, API, wireless).
• Validate the technical controls behind compliance requirements, such as segmentation, hardening, logging and monitoring, access control, encryption and patch management.
• Review firewall, endpoint and network security configurations (e.g., Fortinet, Palo Alto, Cisco, Sophos, CrowdStrike, SentinelOne, Microsoft Defender).
• Translate technical findings into risk-ranked, actionable remediation guidance, and re-test fixes.

Reporting and client engagement

• Produce high-quality reports in English: executive summaries, technical findings, compliance gap reports and remediation plans.
• Present findings and progress to CISOs, IT leads, compliance officers and board-level stakeholders.
• Act as a trusted advisor throughout the engagement, and support pre-sales activities such as scoping, proposals and technical solution input.

Internal contribution

• Help build InfoStream's GRC methodology, templates, toolkits and reusable documentation.
• Mentor junior consultants and security analysts.
• Keep current with changes in Saudi regulations (NCA, SAMA, CST, SDAIA/PDPL) and international standards.

• Bachelor/Honors

• Bachelor's degree in Cyber Security, Information Security, Computer Science, IT or a related field.

• At least 3 years
• The applicants should have experience in the following business area(s): Banks, Insurance, Investment/Merchant Banking, Manufacturing (FMCG), Pharmaceutical/Medicine Companies

• Age 24 to 50 years

• 5+ years of experience in cyber security GRC, with at least 2 years in hands-on technical security testing (VA/PT).
• Proven delivery of PCI DSS and ISO 27001 projects, with working knowledge of at least two of NCA ECC, SAMA CSF and Aramco CCC.
• Strong command of VA/PT methodology and tools (e.g., Nessus, Qualys, Burp Suite, Nmap, Metasploit, Kali toolset) and frameworks such as OWASP, PTES and NIST SP 800-115.
• Exceptional written communication: policy drafting, audit evidence handling and technical report writing, with a portfolio or sample reports you can discuss (anonymised).
• Strong understanding of network, cloud, identity and endpoint security fundamentals.
• Fluent professional English.

Preferred Certifications

At least one from each category is expected, and more is a strong advantage.

Area Certifications

• GRC / audit / management CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer / Lead Auditor
• Payment security PCI Professional (PCIP), PCI ISA, or QSA-qualified (a major plus)
• Offensive / technical OSCP, GPEN, CEH, CompTIA PenTest+, eJPT/eCPPT
• Other relevant CCSP, GRCP, CDPSE, CompTIA Security+ (entry-level baseline)

Desirable Skills

• Experience in banking, fintech, government, oil and gas, or critical infrastructure environments in Saudi Arabia or the GCC.
• Knowledge of PDPL, CST Cloud Cybersecurity Controls, and the NCA CCC/OTCC/DCC family.
• Familiarity with GRC platforms (e.g., Archer, ServiceNow GRC, OneTrust, Vanta/Drata-type tools).
• Scripting ability (Python, PowerShell, Bash) for automation and evidence collection.
• Experience in a consulting or professional-services environment with multiple concurrent client engagements.

Key Competencies

• Meticulous attention to detail and strong analytical judgement
• Structured, audit-ready documentation discipline
• Clear communication with both technical and non-technical audiences
• Ownership, client focus and ability to manage deadlines across parallel projects
• Integrity and discretion when handling sensitive client data

• Employment status: Contractual
• Workplace: Work from home
• Vacancies: 1
• Salary: Negotiable
• Job location: Anywhere in Bangladesh