Cybersecurity Risk and Resilience Manager

About Us : DirectFN is a leading Capital Market Industry (CMI) Financial Technology software and Content provider, company (now owned by Saudi Tadawul Group / WAMID) specializes in providing brokerage, asset, and custody management solutions, along with market information screens – as productized services. Our innovative products, services, and solutions empower both financial institutions and individuals to optimize their operations and enhance client satisfaction . JOB SUMMARYThe Cybersecurity, Risk and Resilience Manager at DirectFN is responsible for managing and executing the organization's cybersecurity governance, enterprise risk management, and business continuity programs. This role ensures that DirectFN adheres to relevant cybersecurity frameworks, regulatory standards, and risk management policies — protecting the integrity, availability, and confidentiality of DirectFN's systems, financial data platforms, and client-facing services. The Manager works closely with IT, technology, legal, and compliance teams, and reports directly to the COO, overseeing a cybersecurity specialist and contributing to the operational resilience of a leading fintech company in the Saudi capital markets ecosystem.II.

Key Responsibilities

1. Cybersecurity Governance

• Collaborate with IT and technology teams to ensure alignment with cybersecurity frameworks including ISO 27001, NIST, and SAMA Cybersecurity Framework (CSF).
• Oversee cybersecurity policy development, maintenance, and enforcement across the organization.
• Conduct and coordinate risk assessments, vulnerability management activities, and incident response planning.
• Engage, manage, and monitor third-party vendors for cybersecurity assessments and timely remediation of identified risks.
• Monitor third-party vendor compliance with DirectFN's cybersecurity standards and contractual security obligations.2. Enterprise Risk Management
• Operate the end-to-end enterprise risk program — identifying, assessing (likelihood and impact), treating, and monitoring risks across all business functions.
• Maintain a living risk register, applying consistent and practical scoring methodologies aligned with organizational risk appetite and tolerances.
• Conduct quarterly risk reviews with relevant business units and provide updated risk reporting to senior leadership.
• Map identified risks to controls drawn from ISO 27001 or equivalent control frameworks to ensure a robust control environment.
• Coordinate internal audits, manage corrective action plans, and prepare for external audits including ISO 27001 and SOC 2.
• Develop and maintain Key Risk Indicators (KRIs) and executive risk dashboards for leadership reporting.
• Liaise on cyber insurance underwriting data requirements and support the inclusion of risk clauses in customer and supplier contracts.3. Business Continuity & Operational Resilience
• Lead the development, maintenance, and periodic testing of Business Continuity Plans (BCP) across DirectFN's critical business functions.
• Conduct Business Impact Assessments (BIA) and risk analyses to identify critical dependencies, recovery time objectives, and resilience gaps.
• Coordinate cross-functional continuity exercises and drills to validate the effectiveness of continuity strategies.
• Ensure DirectFN's operational resilience practices comply with relevant regulatory mandates, including SAMA and NCA requirements.4. Compliance & Regulatory Management
• Maintain current knowledge of applicable regulatory frameworks including SAMA, NCA, GDPR, and ISO 27001, and ensure DirectFN's practices remain compliant.
• Support internal and external compliance reviews, audits, and regulatory submissions related to cybersecurity and risk.
• Provide guidance to business units on regulatory obligations and the implementation of required controls.5. Incident & Breach Management
• Manage the cybersecurity incident response process — from detection and containment through investigation, remediation, and post-incident review.
• Maintain incident response plans, playbooks, and communication protocols for various breach and disruption scenarios.
• Coordinate with legal, communications, and senior leadership in the event of a material cybersecurity incident or data breach.6. Team Oversight & Stakeholder Engagement
• Provide day-to-day direction and oversight to the Cybersecurity Specialist, ensuring effective execution of security operations and monitoring activities.
• Engage cross-functionally with IT, engineering, product, legal, and operations teams to embed security and risk awareness across the organization.
• Prepare and present cybersecurity and risk management reports to the COO and relevant leadership stakeholders.III. Qualifications & Requirements:○ Education: Bachelor's degree in IT Security, Information Systems, Finance, Law, or a related field; Master's degree preferred.○ Experience: Minimum 7 years of experience in cybersecurity governance, IT risk management, or compliance within financial services or fintech.○ Strong understanding of regulatory frameworks including SAMA CSF, NCA ECC, ISO 27001, NIST, and GDPR.○ Proven experience managing enterprise risk programs, conducting risk assessments, and maintaining risk registers.○ Hands-on experience with business continuity planning, BIA, and operational resilience frameworks.○ Excellent analytical, communication, and stakeholder management skills.○ Fluent in English (spoken and written); Arabic is an advantage.IV. Prefer to Have:○ Professional certifications such as CISSP, CISM, CRCM, CCEP, ISO 27001 Lead Implementer/Auditor, or ISO 22301.○ Experience working within Saudi Arabia's regulatory environment, particularly with SAMA and NCA cybersecurity requirements.○ Familiarity with SOC 2 audit preparation and cyber insurance underwriting processes.V. Core Skills:○ Cybersecurity Governance: Deep knowledge of cybersecurity frameworks, policy development, and risk-based security management.○ Risk Management: Structured, practical approach to enterprise risk identification, assessment, and mitigation.○ Regulatory Awareness: Current and comprehensive understanding of cybersecurity and operational compliance obligations in the KSA and GCC.○ Incident Management: Composed and methodical in managing security incidents, breaches, and business disruptions.○ Stakeholder Communication: Able to translate technical risk concepts into clear, actionable insights for non-technical leadership.○ Ethical Judgment: Maintains high standards of integrity and confidentiality in all risk and security activities.VI. Key Result Areas (KRAs):○ Regulatory Compliance: DirectFN's cybersecurity and risk practices consistently meeting SAMA, NCA, and relevant international standards.○ Risk Posture: A well-maintained, up-to-date risk register with active treatment plans and clear ownership across the organization.○ Incident Readiness: Tested, documented incident response and business continuity plans that enable rapid and effective response to disruptions.○ Audit Readiness: Successful internal and external audits with minimal findings and timely closure of corrective actions.Organizational Awareness: Improved security and risk awareness across DirectFN through governance, training, and cross-functional engagement