Lead, Cyber Security Assurance

Job summary:

To operationalise, manage, and continuously enhance TAQA Distribution’s cyber security assurance framework, ensuring that security policies, standards, controls, and compliance requirements are consistently implemented across IT environments.

The Lead, Cyber Security Assurance is responsible for executing cyber assurance activities — including security compliance monitoring, control assessments, vulnerability management, audit coordination, and risk tracking — providing the operational backbone that enables the Manager, Cyber Security Assurance to focus on strategy, governance, and risk oversight.

This role acts as a subject matter expert in cyber security assurance, ensuring that security risks are proactively identified, controls are tested effectively, and regulatory and organisational security requirements are met across TAQA’s technology landscape.

General Responsibilities:

• Policy, Procedures, Process and Systems
• Ensure the compliance of organization’s policy, systems, processes, procedures, and controls in line with group delegation of authority policy so that all relevant procedural/legislative requirements are fulfilled while delivering a quality, cost-effective service in a consistent manner.
• Reporting
• Ensure that all reports are completed timely and comply with the business policies and standards.
• Manage the preparation of periodical management reports and progress reports to keep the business senior management informed about the progress of various initiatives and to facilitate decision-making.
• Comply with organization’s requirements in a timely manner.

Job Specific Responsibilities:

• Operationalise and maintain TAQA Distribution’s cyber security assurance framework, ensuring policies, standards, and controls are effectively implemented across IT environments.
• Monitor and assess compliance with cyber security standards (e.g., ISO 27001, SAMA, NIST CSF), identifying control gaps and supporting remediation actions across business and IT teams.
• Conduct and coordinate security control assessments, compliance reviews, and assurance activities, ensuring alignment with internal policies and regulatory requirements.
• Support cyber security audit activities (internal and external), including preparation of audit evidence, coordination with auditors, tracking findings, and ensuring timely closure of audit issues.
• Maintain and manage the cyber security risk register, tracking identified risks, assessing impact, and ensuring mitigation actions are defined, assigned, and monitored.
• Coordinate vulnerability management and remediation tracking, working with infrastructure, application teams to ensure vulnerabilities are addressed in a timely manner.
• Prepare and publish cyber security dashboards and reports, providing visibility on compliance posture, risk exposure, and control effectiveness.
• Support implementation and monitoring of security controls across enterprise and operational systems, including identity management, access controls, data protection, and network security.
• Collaborate with IT and business stakeholders to ensure security requirements are embedded into projects and operational processes.
• Facilitate cyber security governance forums and working groups, including meeting coordination, documentation, and action tracking.
• Provide advisory support to project teams and business units on cyber security policies, standards, and assurance requirements.
• Support development and execution of cyber security awareness and training initiatives, promoting a strong security culture across the organisation.
• Stay current with evolving cyber threats, regulatory requirements, and best practices, and embed these into TAQA’s cyber security assurance practices

HSE, Security, and Risk Protocols:

• The Employee shall adhere to all the HSE, Security and Risk Management Rules & Procedures communicated by the company, including:
• Taking reasonable care of their own health, safety, and security.
• Taking reasonable care of the health, safety and security of persons that may be affected by their acts or omissions at work.
• Co-operate with their employer with respect to any instruction and/or actions taken by the employer to protect the employee and/ or comply with HSE and security requirements.
• Report to their immediate line manager any situation which they have reason to believe could present a risk, hazard, or issue to an individual or the company and which they cannot correct themselves.
• Report all HSE and security incidents and work-related injuries.
• Not intentionally or recklessly interfere with or misuse anything provided at the workplace that supports the interest of HSE, security and welfare.

People Management Responsibilities:

• Leadership
• Actively participate in continuous improvement and professional development activities. Support decisions made with integrity and transparency, always aligning with the entity's goals.
• Talent Management
• Engage in talent development programs aimed at enhancing skills and supporting career progression. Contribute to a team culture that is connected to the organization's larger purpose.
• Culture
• Uphold and promote the organization's values within the team. Foster a collaborative and innovative work environment through active participation and support.
• Communication
• Support informed decision-making within the team. Contribute to clear and effective communication, ensuring alignment with organizational objectives and facilitating smooth information flow up and down the chain.

Competencies

Technical Competencies:

• Strong understanding and hands-on experience with cyber security frameworks and standards (ISO 27001, NIST, CIS, SAMA Cybersecurity framework)
• Experience in security assurance, compliance monitoring, and control testing, including audit preparation and remediation tracking.
• Knowledge of vulnerability management, risk assessment, and security control implementation across IT environments.
• Familiarity with security tools and technologies, including SIEM, vulnerability scanners, identity and access management systems, and endpoint security tools.
• Ability to apply risk-based approaches to security assurance, prioritising remediation efforts based on business impact.
• Leverage AI-powered tools to enhance reporting, risk analysis, and operational efficiency within cyber assurance processes.

Strategic & Business Competencies

• Strong understanding of TAQA Distribution’s IT landscape, regulatory environment, and operational risk profile.
• Ability to align cyber security assurance activities with business priorities and regulatory expectations.
• Stakeholder management and advisory capability across IT and business teams.

Essential Requirements

• Bachelor’s degree in Information Technology or equivalent
• 6 years of relevant working experience

Desired Requirements

• Master’s degree in Information Technology or equivalent
• 9 years of relevant working experience