Cybersecurity Architect – Security Governance, Cloud & GRC

Location

Riyadh, Saudi Arabia — On-site

• Information Technology (IT) & Software
• Security & Defence
• Legal & Compliance
• Banking & Insurance
• Telecommunications

VaporVM is seeking an experienced Cybersecurity Architect to join its team in Riyadh, Saudi Arabia. This on-site opportunity is suitable for cybersecurity professionals with 8–12 years of experience and strong expertise across security architecture, governance, risk and compliance, vulnerability management, threat monitoring, incident response, and cloud security.

The role requires comprehensive knowledge of cybersecurity frameworks and Saudi regulatory requirements, including ISO 27001:2022, SAMA-CSF, NCA, PDPL, and CST CRF
. The successful candidate will work across security governance, penetration testing, vulnerability management, SIEM, cloud, application, API, and IoT security, as well as vendor and third-party risk assessments.

This position offers opportunities for career growth and professional development within cybersecurity architecture, GRC, security engineering, cloud security, and regulatory compliance. Relevant certifications and specialized cybersecurity training can further strengthen long-term career progression.

• Develop and support cybersecurity architecture and security strategies.
• Apply relevant cybersecurity frameworks, standards, and regulatory requirements.
• Support compliance with ISO 27001:2022, SAMA-CSF, NCA, PDPL, and CST CRF requirements.
• Manage and support security governance, GRC, and enterprise risk-management activities.
• Assess security risks and recommend appropriate mitigation strategies.
• Support penetration testing and vulnerability management programs.
• Monitor security threats and support SIEM and incident-response activities.
• Apply security controls across cloud, applications, APIs, and IoT environments.
• Assess security risks throughout the technology and application lifecycle.
• Apply security testing and assessment methodologies aligned with OWASP Top 10, PTES, and MITRE ATT&CK.
• Conduct or support vendor security assessments and third-party risk reviews.
• Collaborate with technology, infrastructure, application, compliance, and business stakeholders.
• Support continuous improvement of cybersecurity controls, policies, and architecture.

• 8–12 years of professional cybersecurity experience
  .
• Current residence in Saudi Arabia is required.
• Availability as an immediate joiner is required.
• Strong knowledge of:
  • ISO 27001:2022
  • SAMA Cyber Security Framework (SAMA-CSF)
  • National Cybersecurity Authority (NCA) requirements
  • Personal Data Protection Law (PDPL)
  • CST Cybersecurity Regulatory Framework (CST CRF)
• Strong experience in Security Governance, GRC, and Risk Management.
• Experience with penetration testing and vulnerability management.
• Knowledge of SIEM, threat monitoring, and incident response.
• Experience with cloud, application, API, and IoT security.
• Strong understanding of OWASP Top 10, PTES, and MITRE ATT&CK.
• Experience in vendor security and third-party risk assessments.
• Strong analytical, communication, stakeholder-management, and problem-solving skills.

• CISM
• CISA
• ISO 27001 Lead Auditor
• ISO 27001 Lead Implementer
• CAP or equivalent cybersecurity certification

Salary: Up to SAR 14,000 per month
, based on the job posting.

The position provides opportunities for career growth and professional development across cybersecurity architecture, security governance, GRC, regulatory compliance, cloud security, vulnerability management, and threat response. Candidates can further strengthen their professional profile through certifications such as CISM, CISA, ISO 27001 Lead Auditor/Implementer, CAP, and other relevant cybersecurity credentials.

Joining: Immediate joiner required

Location Requirement: Candidates must currently be based in Saudi Arabia.