GRC SME - Contract

We are seeking a highly experienced GRC Subject Matter Expert (SME) to support and lead Governance, Risk & Compliance initiatives for a leading organization in Al Khafji, Saudi Arabia.The ideal candidate will possess deep expertise in NCA Essential Cybersecurity Controls (ECC), Business Continuity Management (ISO 22301), Cybersecurity Governance, Risk Management, Compliance Assessments, and Audit Activities. The candidate must have proven experience acting as the primary SME, leading GRC programs from design through implementation while advising senior management and business stakeholders.Previous experience within the Oil & Gas sector is highly preferred.Key ResponsibilitiesGRC Leadership & SME ResponsibilitiesAct as the organization's primary Subject Matter Expert (SME) for Governance, Risk & Compliance.Lead and manage enterprise-wide GRC initiatives and strategic programs.Provide expert guidance to senior management on cybersecurity governance, risk management, compliance, and business continuity matters.Design, develop, and implement advanced GRC frameworks, methodologies, and operating models.Serve as the lead advisor for GRC projects, assessments, audits, and compliance initiatives.Mentor and support internal teams on GRC best practices.Governance & Risk ManagementDevelop cybersecurity governance frameworks, policies, standards, procedures, and guidelines.Establish and maintain enterprise risk management programs.Lead risk identification, assessment, treatment, mitigation, and monitoring activities.Create and manage organizational risk registers.Define and monitor Key Risk Indicators (KRIs).Present risk findings and recommendations to leadership and stakeholders.Compliance & Regulatory AssessmentsLead compliance assessments against:NCA Essential Cybersecurity Controls (ECC)Saudi cybersecurity regulatory requirementsISO 27001Other applicable cybersecurity frameworksConduct gap assessments and develop remediation plans.Ensure ongoing compliance with regulatory and internal requirements.Support external audits and regulatory inspections.Cybersecurity Audits & Maturity AssessmentsPlan and execute cybersecurity audits and control reviews.Conduct cybersecurity maturity assessments.Evaluate control effectiveness and identify improvement opportunities.Develop detailed assessment reports and executive presentations.Track remediation actions until closure.Business Continuity Management (BCM)Lead BCM initiatives aligned with ISO 22301.Conduct Business Impact Analysis (BIA).Develop, review, and maintain:Business Continuity Plans (BCP)Disaster Recovery Plans (DRP)Crisis Management ProceduresFacilitate BCM testing, tabletop exercises, and awareness programs.Ensure organizational readiness and resilience.Stakeholder & Client ManagementAct as the primary point of contact for GRC engagements.Build strong relationships with customers, regulators, management, and internal stakeholders.Lead workshops, awareness sessions, and executive presentations.Provide strategic recommendations on governance, risk, compliance, and cybersecurity improvements.Due Diligence & Strategic AdvisorySupport mergers and acquisitions due diligence activities.Evaluate cybersecurity, compliance, and risk exposure during acquisitions.Provide recommendations to executive management regarding risk posture and mitigation strategies.Required QualificationsBachelor's Degree in: Cybersecurity, Information Security, Information Technology, Computer Science or Related fieldRequired ExperienceMinimum 5-7+ years of experience in:Governance, Risk & Compliance (GRC)Cybersecurity GovernanceRisk ManagementCompliance ManagementBusiness Continuity ManagementProven experience acting as a lead SME, consultant, or advisor.Strong hands-on experience with NCA ECC.Strong experience implementing or assessing ISO 22301 BCM programs.Experience leading risk assessments and compliance reviews.Experience managing enterprise risk registers.Experience leading audits and maturity assessments.Experience engaging directly with senior management and executive stakeholders.Oil & Gas industry experience preferred.Required CertificationsCISSPCISMCISACRISCGSECISO 27001 Lead ImplementerISO 27001 Lead AuditorPCIPAdditional BCM or Risk certifications are advantageous.Technical SkillsNCA Essential Cybersecurity Controls (ECC)ISO 22301ISO 27001Governance FrameworksEnterprise Risk ManagementRisk RegistersCompliance AssessmentsCybersecurity AuditsBCM & Disaster RecoveryThird-Party Risk ManagementPolicy & Procedure DevelopmentCybersecurity Maturity AssessmentsGRC Platforms & Tools