Cybersecurity Risk Management Consultant

Minimum Qualification & Requirements:• Minimum 10+ years of experience in Cybersecurity Governance, Risk & Compliance• Experience in the National Cybersecurity Authority (NCA) Cybersecurity Controls and Third-Party Cybersecurity requirements.• Experience in conducting Third-Party Risk Assessments (TPRA) and Vendor Risk Management (VRM) engagements.• Experience in assessing vendor cybersecurity governance, policies, procedures, and technical security controls.• Experience in conducting compliance and gap assessments against regulatory and cybersecurity frameworks.• Relevant professional certifications (e.g., CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Auditor or equivalent).• Experience in working in large or regulated organizations. Detailed Deliverables• Conduct a comprehensive Third-Party Risk Assessment for the organization's existing and expected third-party vendors in accordance with the applicable NCA Cybersecurity Controls and Takamol Cybersecurity requirements.• Review and assess third-party cybersecurity documentation, policies, procedures, and implemented security controls.• Evaluate vendor compliance against the applicable NCA requirements and identify cybersecurity compliance gaps.• Assess the risks associated with identified gaps and assign appropriate risk ratings based on their impact and likelihood.• Prepare a detailed Third-Party Risk Assessment Report, including assessment methodology, findings, risk ratings, and recommendations for improvement.• Develop a prioritized remediation plan with actionable recommendations to address identified gaps and improve compliance.• Present the assessment results and recommendations to the relevant stakeholders and support clarification sessions, if required.• Provide all assessment evidence, working papers, and documentation required to support Internal Audit observations and demonstrate compliance with NCA requirements.• Track and validate the implementation of risk treatment actions with risk owners and confirm that identified risks are appropriately remediated before closure.