Cybersecurity Specialist

Role Overview

Saudi Gold Refinery is seeking a Cybersecurity Specialist in Riyadh Saudi Arabia to protect our digital infrastructure and sensitive geological data This role secures the IT and operational technology systems supporting our exploration projects and refining operations The specialist ensures compliance with National Cybersecurity Authority regulations and safeguards critical business information from cyber threats The Cybersecurity Specialist will report directly to the IT Manager and will play a key role in implementing security controls and monitoring threats The position drives the technical execution of our cybersecurity strategy to support SGR s growth and operational continuity

• Security Monitoring The role monitors security information and event management SIEM logs to detect and respond to potential threats in real time
• Incident Response This position investigates security alerts and performs root cause analysis to prevent recurrence of incidents and minimize business impact
• Vulnerability Management The specialist executes monthly vulnerability scans on all network assets and prioritizes remediation efforts based on risk severity
• Access Control The role administers user accounts and access rights in Active Directory to enforce least-privilege principles for all employees
• Regulatory Compliance This position ensures IT security practices align with National Cybersecurity Authority Essential Cybersecurity Controls and internal policies
• Security Training The specialist delivers quarterly cybersecurity awareness sessions to employees covering phishing password hygiene and data protection
• Risk Assessment The role conducts periodic risk assessments to identify gaps in security controls for IT and operational technology environments
• Vendor Security This position reviews third-party vendor security postures to ensure supply chain risks are managed effectively and documented

• Achieves full compliance with NCA Essential Cybersecurity Controls for all corporate IT systems within 12 months
• Reduces mean time to detect MTTD and mean time to respond MTTR to security incidents by 20 percent
• Completes quarterly vulnerability scans with 95 percent of critical vulnerabilities remediated within 30 days
• Implements multi-factor authentication for 100 percent of remote access users and privileged accounts
• Delivers cybersecurity awareness training to 100 percent of employees with a measurable reduction in phishing click rates
• Establishes a documented incident response plan and conducts two successful tabletop exercises with key stakeholders
• Maintains zero major security breaches resulting from unpatched known vulnerabilities

Saudi Gold Refinery welcomes applications from all qualified candidates Hiring decisions are made based on role requirements skills experience and alignment with Saudization and Vision 2030 priorities

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• Minimum of three years of experience in cybersecurity operations, incident response, or vulnerability management.
• Proven knowledge of network security protocols, firewalls, intrusion detection systems, and endpoint protection.
• Experience with security information and event management (SIEM) tools and log analysis.
• Familiarity with National Cybersecurity Authority (NCA) regulations and Saudi data protection laws.
• Strong understanding of identity and access management principles and Active Directory administration.
• Ability to communicate technical security concepts to non-technical stakeholders clearly and effectively.
• Valid Saudi driving license and willingness to travel to exploration sites within the Kingdom as required.
• Preferred / Nice-to-have Experience securing operational technology (OT) or industrial control systems in mining or industrial environments.
• Knowledge of cloud security principles for Azure or AWS environments.
• Previous experience in the mining, refining, or natural resources sector.
• Proficiency in Arabic language for local regulatory correspondence and staff training.
• Certifications such as CompTIA Security+, CISSP, or CEH.