Cybersecurity Risk and Resilience Manager

DirectFN is a leading Capital Market Industry (CMI) Financial Technology software and Content provider, company (now owned by Saudi Tadawul Group / WAMID) specializes in providing brokerage, asset, and custody management solutions, along with market information screens – as productized services. Our innovative products, services, and solutions empower both financial institutions and individuals to optimize their operations and enhance client satisfaction

The Cybersecurity, Risk and Resilience Manager at DirectFN is responsible for managing and executing the organization's cybersecurity governance, enterprise risk management, and business continuity programs. This role ensures that DirectFN adheres to relevant cybersecurity frameworks, regulatory standards, and risk management policies — protecting the integrity, availability, and confidentiality of DirectFN's systems, financial data platforms, and client-facing services. The Manager works closely with IT, technology, legal, and compliance teams, and reports directly to the COO, overseeing a cybersecurity specialist and contributing to the operational resilience of a leading fintech company in the Saudi capital markets ecosystem.

• Collaborate with IT and technology teams to ensure alignment with cybersecurity frameworks including ISO 27001, NIST, and SAMA Cybersecurity Framework (CSF).
• Oversee cybersecurity policy development, maintenance, and enforcement across the organization.
• Conduct and coordinate risk assessments, vulnerability management activities, and incident response planning.
• Engage, manage, and monitor third-party vendors for cybersecurity assessments and timely remediation of identified risks.
• Monitor third-party vendor compliance with DirectFN's cybersecurity standards and contractual security obligations.
• Operate the end-to-end enterprise risk program — identifying, assessing (likelihood and impact), treating, and monitoring risks across all business functions.
• Maintain a living risk register, applying consistent and practical scoring methodologies aligned with organizational risk appetite and tolerances.
• Conduct quarterly risk reviews with relevant business units and provide updated risk reporting to senior leadership.
• Map identified risks to controls drawn from ISO 27001 or equivalent control frameworks to ensure a robust control environment.
• Coordinate internal audits, manage corrective action plans, and prepare for external audits including ISO 27001 and SOC 2.
• Develop and maintain Key Risk Indicators (KRIs) and executive risk dashboards for leadership reporting.
• Liaise on cyber insurance underwriting data requirements and support the inclusion of risk clauses in customer and supplier contracts.

• Lead the development, maintenance, and periodic testing of Business Continuity Plans (BCP) across DirectFN's critical business functions.
• Conduct Business Impact Assessments (BIA) and risk analyses to identify critical dependencies, recovery time objectives, and resilience gaps.
• Coordinate cross-functional continuity exercises and drills to validate the effectiveness of continuity strategies.
• Ensure DirectFN's operational resilience practices comply with relevant regulatory mandates, including SAMA and NCA requirements.

• Maintain current knowledge of applicable regulatory frameworks including SAMA, NCA, GDPR, and ISO 27001, and ensure DirectFN's practices remain compliant.
• Support internal and external compliance reviews, audits, and regulatory submissions related to cybersecurity and risk.
• Provide guidance to business units on regulatory obligations and the implementation of required controls.

• Manage the cybersecurity incident response process — from detection and containment through investigation, remediation, and post-incident review.
• Maintain incident response plans, playbooks, and communication protocols for various breach and disruption scenarios.
• Coordinate with legal, communications, and senior leadership in the event of a material cybersecurity incident or data breach.

• Provide day-to-day direction and oversight to the Cybersecurity Specialist, ensuring effective execution of security operations and monitoring activities.
• Engage cross-functionally with IT, engineering, product, legal, and operations teams to embed security and risk awareness across the…