{"id":2670600,"url":"https://alion.io/job/tabby-information-security-specialist","title":"Information Security Specialist","company":{"id":255,"name":"Tabby","domain":"tabby.ai","url":"https://alion.io/company/tabby","size_band":"201-500","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Pinpoint","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Riyadh, Saudi Arabia"],"countries":["SA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":25000,"max_usd":69000,"period":"year","method":"global_role_cell_scaled_by_country","sample_n":528},"experience_years_min":1,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"ISO 27001","optional":false},{"name":"PCI DSS","optional":false}],"status":"live","first_seen_at":"2026-10-15T04:11:35Z","employer_posted_date":"2026-10-15","last_verified_at":"2026-10-17T09:01:21Z","board_verified":true,"closed_at":null,"days_open":2,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":2},"description":"We're looking for an Information Security Specialist (GRC) to join Tabby! The successful candidate will independently execute governance, risk, and compliance activities across the Tabby's information security programme.\nKey Responsibilities\n Information Security Governance\nMaintain and update the information security governance framework documentation, policy library, and associated standards and procedures.\nDraft and revise information security policies, standards, and baselines, ensuring alignment with applicable regulatory requirements and business objectives.\nMonitor and track changes in legal, regulatory, and contractual requirements affecting information security (SAMA CSF, PDPL, NCA ECC, PCI-DSS), updating the compliance register accordingly.\nMaintain and update role and responsibility matrices (RACI), information security governance committee documentation, and reporting packs.\nCoordinate security governance committee meetings - preparing agendas, minutes, and action tracking.\nProduce internal and external communication materials related to information security governance, policies, and programme updates.\n Information Risk Management\nExecute information security risk assessments independently, applying the organization's risk assessment methodology and producing complete risk registers with identified threats, vulnerabilities, likelihood, impact, and treatment plans.\nMaintain and update the information asset register - tracking asset owners, classifications, and associated risk profiles.\nLead business impact assessment (BIA) data collection activities, coordinating with asset owners and business units to capture accurate recovery objectives and criticality ratings.\nConduct control effectiveness evaluations for key information security controls, documenting findings and escalating gaps to the Lead for treatment.\nCoordinate third-party information security risk assessments - preparing assessment questionnaires, reviewing vendor responses, and producing risk summaries.\nIntegrate risk and vulnerability data into procurement reviews, project onboarding, and change management processes.\nPrepare periodic risk reports for senior review, highlighting emerging risks, significant changes in the risk profile, and the status of risk treatment actions.\nCompliance & Programme Development\nMonitor the organization's compliance posture against SAMA CSF, NCA ECC, PDPL, ISO 27001, and PCI-DSS - tracking control status, identifying gaps, and coordinating remediation.\nCoordinate internal and external audit activities - gathering evidence packages, liaising with auditors, tracking findings, and monitoring remediation progress.\nSupport the preparation of regulatory submissions, self-assessments, and compliance attestations required by SAMA, NCA, and PCI Council.\nMaintain and enhance the security awareness programme - developing training materials, scheduling communications, and tracking completion metrics.\nMonitor KPIs and KRIs for the information security programme, preparing accurate and timely dashboards for senior management review.\nSupport the integration of information security requirements into procurement, project management, and change control processes.\n Cross-Functional & General GRC Support\nMaintain the information security policy, standard, and procedure library - managing version control, review cycles, and distribution.\nSupport information security initiatives across business and technology teams, providing GRC subject matter expertise on projects and change programmes.\nConduct information classification reviews and document security requirements for key business and IT projects.\nDeliver information security awareness sessions and materials to targeted staff groups.\nProvide analytical support for GRC team reporting, data gathering, and programme tracking activities.\nSkills, Knowledge and Expertise\nBachelor's degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Risk Management, or a related field.\n1-3 years of professional experience in information security governance, risk management, compliance, or a closely related field. Hands-on experience with risk assessment execution, policy development, or compliance monitoring is required. Prior exposure to SAMA CSF, ISO 27001, PDPL, or NCA ECC requirements is a strong advantage. Experience in a regulated Fintech or banking environment is preferred.\nISO 27001 Foundation or Lead Implementer (preferred). CompTIA Security+ or equivalent. \nWorking toward CRISC (Certified in Risk and Information Systems Control) or CISM.\nBenefits\nWe are an international team of inspired professionals located all over the globe.\nWe have an inclusive company culture, embracing diversity, integrity and transparency. We strive for work-life balance and cherish the moments you spend with your loved ones, off-work. In the same spirit as for our product, we are caring and nurturing for our employees.\nOur people are granted 100% trust and freedom to apply their own vision and come up with their ideas from day 1 at Tabby. You are the one who takes responsibility for your area of work. We encourage everyone to think and make decisions like Tabby was their own business, well because it is. Our employee stock options programme is available for everyone. \nYou will have an opportunity to learn and grow in one of the fastest growing fin tech companies in the region\nWe offer you relocation support as well as we guide you through all the process.\nWe’ll set you up with the devices required for your work.","description_format":"text","description_chars":5546,"description_truncated":false,"requirements":{"experience_years_min":1,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Stock options"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":true,"industries":["Buy Now, Pay Later"],"lifecycle":[{"event":"open","at":"2026-10-16T04:11:35Z"}],"visa":[],"liveness":{"score":90,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.903,"p_room":1,"age_days":2,"expected_fill_days":15,"reasons":["conf:0","velocity","win:early","comp:junior"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/tabby-information-security-specialist","json_url":"https://alion.io/job/tabby-information-security-specialist.json","meta":{"generated_at":"2026-10-17T10:09:21Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13282,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":255},"rest":"https://alion.io/mcp/rest/get_company?id=255"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ftabby-information-security-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ftabby-information-security-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ftabby-information-security-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/tabby-information-security-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ftabby-information-security-specialist"}]}