Business Analyst

We are looking for an experienced GRC Risk and Compliance Analyst with strong knowledge of information-security controls, compliance frameworks, audit preparation, and evidence-management processes.

The successful candidate will support the mapping, assessment, implementation, monitoring, and documentation of information-security controls against frameworks such as CIS Controls, NCA ECC, and ISO/IEC 27001
.

The role will involve working with Information Security, Technology, Risk, Compliance, Internal Audit, external auditors, control owners, and business stakeholders to ensure that controls are properly designed, implemented, evidenced, and tracked through remediation.

Key Responsibilities:

• Map organizational security controls against:
  
  CIS Controls
• NCA Essential Cybersecurity Controls
• ISO/IEC 27001
• Other applicable regulatory or security frameworks
• Maintain control matrices, control libraries, evidence registers, and compliance documentation.
• Coordinate audit and compliance evidence-collection workflows.
• Work with control owners to obtain, validate, and organize audit evidence.
• Assess evidence for completeness, relevance, validity, and coverage.
• Identify control gaps, exceptions, and remediation requirements.
• Track risks, findings, corrective actions, and remediation activities through closure.
• Support internal audits, external audits, regulatory assessments, and compliance reviews.
• Prepare audit-readiness reports, compliance dashboards, status updates, and management presentations.
• Maintain audit trails and ensure evidence is stored in a structured and traceable manner.
• Support risk assessments and control-effectiveness reviews.
• Coordinate with Technology, Infrastructure, Cloud, Applications, IAM, SOC, Privacy, and Business teams.
• Review policies, standards, procedures, and control descriptions.
• Support the implementation and continuous improvement of GRC processes.
• Ensure control owners understand their responsibilities, evidence requirements, review frequency, and remediation timelines.
• Monitor changes in applicable regulatory and security requirements.

Required Skills:

• Minimum 5 years of GRC, information-security risk, IT risk, compliance, or cybersecurity governance experience
  .
• Practical experience with CIS Controls
  .
• Experience with NCA ECC or equivalent cybersecurity regulatory controls.
• Strong experience with ISO/IEC 27001 control mapping
  .
• Experience coordinating audits and evidence-collection workflows.
• Experience maintaining control matrices and compliance documentation.
• Knowledge of risk, control, audit, issue, and remediation-management processes.
• Strong documentation, analysis, coordination, and stakeholder-management skills.
• Ability to work with technical and non-technical control owners.
• Experience preparing reports and presentations for management or audit committees.

Preferred

Skills:

• Experience with GRC platforms such as:
  
  Service Now GRC
• RSA Archer
• Metric Stream
• One Trust
• Logic Gate
• Audit Board
• IBM Open Pages
• ISO/IEC 27001 Lead Implementer or Lead Auditor certification.
• CISA, CRISC, CISSP, CISM, or equivalent.
• Experience with COBIT, NIST CSF, NIST 800-53, PCI DSS, or SOC 2.
• Experience in cloud security compliance.
• Experience with third-party risk management.
• Experience with business continuity, privacy, or operational resilience.
• UAE or Saudi regulatory-compliance experience.
• Experience automating evidence collection and compliance reporting.