# Associate Director - Cybersecurity Risk and Compliance at Qiddiya Investment Company > Open job at Qiddiya Investment Company in Riyadh, Saudi Arabia. Workplace: On-site. Source: Gulf Dev Jobs, https://gulfdevjobs.com/jobs/qiddiya-investment-company-associate-director-cybersecurity-risk-and-compliance-b5skejn Posted 18 August 2026. Last checked on the employer's career site: 3 November 2026. ## Facts - Company: [Qiddiya Investment Company](https://gulfdevjobs.com/companies/qiddiya-investment-company) - Location: Riyadh, Saudi Arabia - Workplace: On-site - Employment type: Full-time - Arabic: Not required - Not mentioned in the job post: salary, housing, flights, visa sponsorship, relocation, where you can apply from ## Job description - **Roles and Responsibilities**: - Conduct periodic and ad hoc cybersecurity risk assessments across IT and OT environments - Perform OT-specific risk assessments on assets such as PLCs, HMIs, RTUs, and engineering systems - Identify and document OT-relevant risk scenarios (e.g., control system disruption, unauthorized access, safety manipulation) - Coordinate risk reviews as part of major IT/OT changes, such as system upgrades or new deployments - Reassess risk posture following major changes, incidents, or regulatory updates - Review and validate existing controls to calculate residual risk and prioritize treatment actions - Provide standardized tools and guidance to support self-assessments by IT, OT, and business teams - Support integration of assessment outcomes into control design, zoning, segmentation, and system deployment - Track risk treatment progress and escalate overdue or high-priority items as needed - Coordinate with performance management to define and monitor key risk indicators (KRIs) to proactively track changes in cybersecurity risk exposure - Maintain the cybersecurity risk register, including OT-specific entries, capturing identified risks, likelihood and impact ratings, treatment plans, ownership, and status - Coordinate and execute internal cybersecurity compliance assessments across all relevant domains and functions - Serve as the lead interface for external audits and regulatory inspections, including preparation, execution, and response - Conduct periodic compliance assessments of OT environments, including SCADA, DCS, PLCs, and associated network infrastructure - Maintain an inventory of compliance-relevant OT assets and map them to applicable control requirements and standards - Monitor adherence to cybersecurity policies, escalate non-compliance, and coordinate corrective actions with relevant teams - Track and manage remediation plans for compliance gaps, non-conformities, and audit findings through closure - Validate the effectiveness of implemented controls or mitigation plans before closing compliance gaps - Review and validate configuration baselines for OT systems (e.g., firewall rules, firmware versions) to ensure alignment with compliance standards - Coordinate evidence collection, documentation, and remediation planning for compliance-related findings - Report OT and IT cybersecurity compliance status and risks to leadership and cybersecurity governance - Support compliance awareness and training for teams with control responsibilities in both IT and OT - Maintain a centralized compliance register, covering both IT and OT, that maps regulatory requirements to policies, controls, responsible teams, and evidence sources - Govern third-party cybersecurity risk by maintaining standardized assessment processes, due diligence criteria, and remediation tracking - Coordinate and conduct third-party cybersecurity assessments across IT and OT suppliers to ensure alignment with internal policies and regulatory requirements - Review vendor-supplied OT systems and supporting documentation to ensure inclusion of security controls and compliance with applicable standards (e.g., NCA OTCC, IEC 62443) - Ensure third-party risk findings are documented, risk-rated, and tracked through resolution, including acceptance or application of compensating controls - Maintain a register of assessed vendors, associated risks, control gaps, and remediation status for ongoing oversight and reporting - Collaborate with procurement, legal, and compliance to embed cybersecurity requirements into third-party agreements, including OT-specific clauses where applicable - Contribute to the development and review of third-party security policy and minimum control requirements for use in procurement and onboarding - Support internal and external audit requests related to third-party cybersecurity risk management **Requirements** - Bachelor's degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field. - Master's degree is preferred. - 10–12+ years of cybersecurity experience. - Strong experience in cybersecurity risk management, compliance, assessments, and assurance. ## How to apply Apply on the job page, https://gulfdevjobs.com/jobs/qiddiya-investment-company-associate-director-cybersecurity-risk-and-compliance-b5skejn: its Apply button opens the employer's own application page. ## More jobs from Qiddiya Investment Company - [Assistant Manager - IT Security Design](https://gulfdevjobs.com/jobs/qiddiya-investment-company-assistant-manager-it-security-design-5rr206d): Qiddiya Investment Company, Riyadh, Saudi Arabia. On-site. Posted 1 November 2026. - [Senior Specialist - SAP Finance - Operations](https://gulfdevjobs.com/jobs/qiddiya-investment-company-senior-specialist-sap-finance-operations-rhblptr): Qiddiya Investment Company, Riyadh, Saudi Arabia. On-site. Posted 27 October 2026. - [Senior Specialist - Cloud Operation](https://gulfdevjobs.com/jobs/qiddiya-investment-company-senior-specialist-cloud-operation-8v3l945): Qiddiya Investment Company, Riyadh, Saudi Arabia. On-site. Posted 25 October 2026. - [IT Systems Specialist Film Studios (SPA5-QPFS0030)](https://gulfdevjobs.com/jobs/qiddiya-investment-company-it-systems-specialist-film-studios-spa5-qpfs0030-8hv8hpl): Qiddiya Investment Company, Riyadh, Saudi Arabia. On-site. Posted 22 October 2026. - [Senior Manager - Security Operations (DEL 5)](https://gulfdevjobs.com/jobs/qiddiya-investment-company-senior-manager-security-operations-07mo03i): Qiddiya Investment Company, Riyadh, Saudi Arabia. On-site. Posted 14 October 2026.