{"id":2667550,"url":"https://alion.io/job/info-stream-cyber-security-grc-consultant-100-remote","title":"Cyber Security GRC Consultant (100% Remote)","company":{"id":4435972,"name":"Info Stream","domain":"infostream.sa","url":"https://alion.io/company/info-stream","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"contractor","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"posting_text","remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":["Bangladesh"],"countries":["BD"],"hiring_countries":["SA","BD"],"hiring_countries_total":2,"salary":null,"salary_estimate":{"min_usd":18000,"max_usd":42000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":2225},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Burp Suite","optional":false},{"name":"Crowdstrike","optional":false},{"name":"ISO 27001","optional":false},{"name":"Metasploit","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Nessus","optional":false},{"name":"Nmap","optional":false},{"name":"OWASP","optional":false},{"name":"PCI DSS","optional":false},{"name":"Qualys Cloud Platform","optional":false},{"name":"SentinelOne","optional":false},{"name":"Sophos","optional":false},{"name":"PowerShell","optional":true},{"name":"Python","optional":true},{"name":"ServiceNow","optional":true}],"status":"live","first_seen_at":"2026-10-05T17:08:00Z","employer_posted_date":null,"last_verified_at":"2026-10-05T17:08:00Z","board_verified":false,"closed_at":null,"days_open":19,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":19},"description":"100% Remote Office Work.\n\nWork on high-visibility compliance and security projects across Saudi Arabia\n\nSupport for certifications and continuous professional development\n\nCompetitive salary and benefits package \n\nResponsibilities & ContextRole Summary\nWe are looking for a Cyber Security GRC Consultant who combines governance and compliance expertise with hands-on technical skills in penetration testing and vulnerability assessment. You will lead compliance engagements from gap assessment to audit readiness. You will also validate controls technically and produce clear, audit-ready documentation and reports for both executive and technical readers.\nThis role suits someone who writes as well as they hack: able to turn a complex finding or control requirement into a precise, defensible document.\nKey Responsibilities\nCompliance consulting and delivery\nLead and deliver PCI DSS (v4.0.x) engagements: scoping, CDE identification, network segmentation review, gap assessment, remediation roadmaps, and readiness for QSA assessment, SAQ or ROC.\nImplement and assess compliance with ISO/IEC 27001:2022, including risk assessment, Statement of Applicability, internal audits and certification readiness.\nPerform gap assessments and implementation support against NCA ECC, Aramco CCC (Third-Party Cybersecurity Standard) and the SAMA Cyber Security Framework, and cross-map controls across frameworks to avoid duplicated effort.\nSupport clients through external audits, certification and regulator assessments.\nGovernance, risk and documentation\nDevelop and review policies, standards, procedures, risk registers, asset inventories, incident response plans, BCP/DR documentation and evidence repositories.\nRun risk assessments and maintain treatment plans aligned to client business context.\nBuild compliance matrices, control mappings, dashboards and management reports.\nTechnical security assessment\nConduct or technically oversee vulnerability assessments (network, systems, cloud, applications) and penetration tests (internal, external, web, API, wireless).\nValidate the technical controls behind compliance requirements, such as segmentation, hardening, logging and monitoring, access control, encryption and patch management.\nReview firewall, endpoint and network security configurations (e.g., Fortinet, Palo Alto, Cisco, Sophos, CrowdStrike, SentinelOne, Microsoft Defender).\nTranslate technical findings into risk-ranked, actionable remediation guidance, and re-test fixes.\nReporting and client engagement\nProduce high-quality reports in English: executive summaries, technical findings, compliance gap reports and remediation plans.\nPresent findings and progress to CISOs, IT leads, compliance officers and board-level stakeholders.\nAct as a trusted advisor throughout the engagement, and support pre-sales activities such as scoping, proposals and technical solution input.\nInternal contribution\nHelp build InfoStream's GRC methodology, templates, toolkits and reusable documentation.\nMentor junior consultants and security analysts.\nKeep current with changes in Saudi regulations (NCA, SAMA, CST, SDAIA/PDPL) and international standards.\n\nEducationBachelor/Honors\nBachelor's degree in Cyber Security, Information Security, Computer Science, IT or a related field.\n\nExperienceAt least 3 years\nThe applicants should have experience in the following business area(s): Banks, Insurance, Investment/Merchant Banking, Manufacturing (FMCG), Pharmaceutical/Medicine Companies\n\nAdditional RequirementsAge 24 to 50 years\n 5+ years of experience in cyber security GRC, with at least 2 years in hands-on technical security testing (VA/PT).\nProven delivery of PCI DSS and ISO 27001 projects, with working knowledge of at least two of NCA ECC, SAMA CSF and Aramco CCC.\nStrong command of VA/PT methodology and tools (e.g., Nessus, Qualys, Burp Suite, Nmap, Metasploit, Kali toolset) and frameworks such as OWASP, PTES and NIST SP 800-115.\nExceptional written communication: policy drafting, audit evidence handling and technical report writing, with a portfolio or sample reports you can discuss (anonymised).\nStrong understanding of network, cloud, identity and endpoint security fundamentals.\nFluent professional English.\nPreferred Certifications\nAt least one from each category is expected, and more is a strong advantage.\nArea Certifications\nGRC / audit / management CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer / Lead Auditor\nPayment security PCI Professional (PCIP), PCI ISA, or QSA-qualified (a major plus)\nOffensive / technical OSCP, GPEN, CEH, CompTIA PenTest+, eJPT/eCPPT\nOther relevant CCSP, GRCP, CDPSE, CompTIA Security+ (entry-level baseline)\nDesirable Skills\nExperience in banking, fintech, government, oil and gas, or critical infrastructure environments in Saudi Arabia or the GCC.\nKnowledge of PDPL, CST Cloud Cybersecurity Controls, and the NCA CCC/OTCC/DCC family.\nFamiliarity with GRC platforms (e.g., Archer, ServiceNow GRC, OneTrust, Vanta/Drata-type tools).\nScripting ability (Python, PowerShell, Bash) for automation and evidence collection.\nExperience in a consulting or professional-services environment with multiple concurrent client engagements.\nKey Competencies\nMeticulous attention to detail and strong analytical judgement\nStructured, audit-ready documentation discipline\nClear communication with both technical and non-technical audiences\nOwnership, client focus and ability to manage deadlines across parallel projects\nIntegrity and discretion when handling sensitive client data\n\nEmployment status: Contractual\nWorkplace: Work from home\nVacancies: 1\nSalary: Negotiable\nJob location: Anywhere in Bangladesh","description_format":"text","description_chars":5649,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Professional development"],"hiring_locations":[{"name":"Saudi Arabia","iso":"SA","kind":"country"},{"name":"Bangladesh","iso":"BD","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security"],"lifecycle":[{"event":"open","at":"2026-10-16T03:09:09Z"}],"visa":[],"liveness":{"score":58,"band":"ok","label":"Likely open","p_open":0.85,"p_active":0.756,"p_room":0.9,"age_days":19,"expected_fill_days":29,"reasons":["seen:19","win:mid"],"computed_at":"2026-10-25T05:49:26Z"},"pay":null,"html_url":"https://alion.io/job/info-stream-cyber-security-grc-consultant-100-remote","json_url":"https://alion.io/job/info-stream-cyber-security-grc-consultant-100-remote.json","meta":{"generated_at":"2026-10-25T07:42:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10797,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-26T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4435972},"rest":"https://alion.io/mcp/rest/get_company?id=4435972"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Finfo-stream-cyber-security-grc-consultant-100-remote"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Finfo-stream-cyber-security-grc-consultant-100-remote"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Finfo-stream-cyber-security-grc-consultant-100-remote"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/info-stream-cyber-security-grc-consultant-100-remote\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Finfo-stream-cyber-security-grc-consultant-100-remote"}]}