Senior GRC & IT Audit Consultant

About the role

The Senior GRC & IT Audit Consultant leads cybersecurity governance, risk management, compliance and audit engagements for clients across multiple industries. You will assess cybersecurity maturity, identify risks, ensure regulatory compliance and provide strategic advice to strengthen security postures.

Key responsibilities

• Lead GRC, cybersecurity governance, risk management and IT audit engagements.
• Conduct cybersecurity and IT risk assessments, gap analyses and maturity assessments.
• Develop and review cybersecurity policies, standards and governance frameworks.
• Perform IT and information security audits, evaluate controls and deliver remediation recommendations.
• Execute compliance assessments against ISO 27001, NIST CSF, NCA ECC, SAMA, GDPR, PCI DSS and other frameworks.
• Maintain risk registers, monitor remediation plans and support enterprise risk initiatives.
• Support incident‑response governance, post‑incident reviews and regulatory reporting.
• Prepare executive reports, dashboards, audit reports and client deliverables.
• Build strong client relationships, present findings to senior management and mentor junior consultants.
• Lead ITSM implementation and process improvement aligned with ISO/IEC 20000 and ITIL best practices.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology or a related field.
• 4–6 years of experience in cybersecurity GRC, IT audit, information security or consulting.
• Professional certifications such as CISA, CRISC, CISSP, CISM or ISO 27001 Lead Auditor/Implementer are preferred.
• Strong analytical, communication and stakeholder‑management skills.
• Fluency in English; Arabic or French is an advantage.

Required skills

• ISO 27001, NIST CSF, NCA ECC, SAMA, GDPR, PCI DSS, COBIT frameworks.
• IT Service Management (ITSM) and ITIL best practices.
• ISO/IEC 20000 readiness and compliance.
• Experience with GRC platforms and IT audit methodologies.
• Knowledge of cybersecurity technologies and risk‑register management.