Role Summary
We are looking for a motivated fresh graduate to join our GRC team. The role supports compliance assessments, policy development, risk management, and audit readiness for clients against standards and regulations such as ISO/IEC 27001, SOC 2, and SAMA Cyber Security Framework. The candidate will work under the guidance of senior consultants and build practical GRC skills across local and international frameworks.
Key Responsibilities
Compliance and Assessments
Support gap assessments against ISO/IEC 27001, SOC 2, SAMA CSF and other applicable frameworks
Map client controls to framework requirements and maintain control matrices
Collect, review, and organize audit evidence
Policies and Documentation
Draft and update information security policies, procedures, and standards
Maintain document version control and review cycles
Prepare assessment reports, status updates, and presentations
Risk Management
Assist in risk identification, assessment, and maintenance of risk registers
Track risk treatment plans and remediation actions
Audit Support
Support internal and external audit preparation
Track audit findings and follow up on corrective actions
Other
Support third-party / vendor risk assessments and security questionnaires
Assist with security awareness material and training sessions
Keep up to date with changes in regulations and standards
Required Qualifications
Bachelor's degree in Computer Science, Information Security, Software Engineering, IT, or a related field
Basic understanding of GRC concepts: governance, risk management, compliance, and internal controls
Basic knowledge of:
ISO/IEC 27001 (ISMS structure, clauses, Annex A controls)
SOC 2 (Trust Services Criteria: Security, Availability, Confidentiality, Processing Integrity, Privacy)
SAMA Cyber Security Framework (domains, maturity levels)
Understanding of core security concepts: CIA triad, access control, encryption, network security, incident management, business continuity
Good written and verbal communication skills in English
Proficiency in MS Word, Excel, and PowerPoint
Preferred (Nice to Have)
Awareness of other frameworks: NCA ECC, NIST CSF, PCI DSS, GDPR / Saudi PDPL
Entry-level certifications such as ISC2 CC, CompTIA Security+, or ISO/IEC 27001 Foundation / Lead Implementer
Internship, final year project, or coursework related to cybersecurity or GRC
Exposure to GRC tools or ticketing / tracking tools
Arabic language skills
Key Competencies
Attention to detail and structured documentation
Analytical thinking and willingness to learn
Ability to manage multiple tasks and meet deadlines
Professional conduct with clients and handling of confidential information
Team player with a proactive attitude
What We Offer
Structured learning and mentorship from experienced GRC professionals
Hands-on exposure to international and KSA regulatory projects
Certification support and career growth path within GRC
[Benefits as per company policy]