Cybersecurity GRC Engineer

About the role

The Cybersecurity GRC Engineer safeguards the organization’s digital assets while advancing its cybersecurity governance maturity. This position blends operational defense—threat detection, vulnerability management, and security infrastructure maintenance—with strategic risk oversight, compliance enforcement, and audit readiness.

Key responsibilities

• Perform root‑cause analysis and assist in remediation of security breaches.
• Conduct vulnerability assessments and ensure timely patching and configuration updates.
• Collaborate with IT teams to protect systems, networks, and cloud environments.
• Develop and enforce security policies, procedures, and standards aligned with ISO 27001, NIST, and internal audit requirements.
• Maintain the information‑security risk register and manage control assessments.
• Support third‑party risk assessments and internal/external audit readiness.
• Perform risk and impact assessments for IT and business processes, proposing mitigation plans.
• Monitor compliance with data‑protection laws, regulatory standards, and internal controls.
• Build dashboards and metrics for key risk and performance indicators.
• Provide reports on incident response, compliance gaps, and control effectiveness.
• Document security incidents, investigations, and preventive actions.
• Review technical risks and security implications during change‑management processes.
• Stay updated on cybersecurity trends, threat intelligence, and emerging technologies.
• Recommend tools and best practices to enhance detection, prevention, and recovery capabilities.
• Participate in security projects, system upgrades, and cross‑departmental initiatives to improve maturity.

Required profile

• Bachelor’s degree in Computer Science, Information Security, Engineering or a related field.
• Relevant certifications such as CompTIA Security+, CEH, eJPT, ECIR, GIAC, CRISC, ISO 27001 Lead Implementer/Auditor.
• Fluent in English and Arabic; French is a plus.
• Strong grasp of cybersecurity principles, risk assessment, incident response, and threat intelligence.
• Familiarity with industry frameworks: ISO 27001, NIST CSF, CIS Controls.
• Good understanding of IT infrastructure and access controls.

Required skills

• CompTIA Security+
• CEH
• eJPT
• ECIR
• GIAC
• CRISC
• ISO 27001 Lead Implementer
• ISO 27001 Lead Auditor
• ISO 27001 framework
• NIST Cybersecurity Framework
• CIS Controls