Cyber & Information Security Specialist

Role overview

This position is focused on strengthening the bank’s information security posture by defining, administering, and enforcing access controls and security mechanisms that safeguard IT assets. The role also involves identifying, tracking, and monitoring cyber and information security threats, supporting service operations, and carrying out bank-wide asset risk assessments to help monitor overall risk exposure across Riyad Bank.

Key responsibilities

• Work in line with department policies, procedures, SOPs, and instructions to ensure tasks are completed in a controlled and consistent way.
• Handle day-to-day activities tied to the role so operational continuity is maintained.
• Review current and new technology systems and applications to verify alignment with security policies and recommend remedies where gaps are found.
• Identify methods, tools, and approaches that improve protection against security breaches, and provide support on forensic matters to reduce exposure to threats.
• Monitor and support the proper implementation of security systems and tools so security operations comply with policy and standards.
• Prepare analytical reporting on security compliance for management review.
• Carry out security enforcement reviews for existing systems and newly introduced systems.
• Develop and document enforcement rules across the full IT stack, including applications, databases, systems, infrastructure, and endpoint devices, based on security policies and standards.
• Keep an updated record of security controls derived from applicable policies and standards.
• Assess security policies and standards for design effectiveness and practicality of enforcement.
• Examine applications and infrastructure for policy compliance and apply controls to reduce identified risks.
• Interpret business and technical needs for initiatives and suggest security solutions that align with policies and standards.
• Guide project teams on implementing security controls and meeting security requirements.
• Analyze operational and technical issues to uncover breakdowns in security controls, then recommend and apply corrective controls where needed.
• Apply vulnerability management practices in accordance with the vulnerability management policies and framework.
• Review infrastructure and security control systems for alignment with baseline security standards and report compliance status to relevant teams and management.
• Ensure all systems are included in vulnerability scanning and that scans are performed regularly.
• Share vulnerability findings with the right stakeholders on time, including aging analysis and KPI reporting.
• Review and strengthen identity and access management controls across systems and applications.
• Inspect code security scan results to confirm source code is free from security weaknesses and help remediate any issues found.
• Review remote access privileges, remove unnecessary access, and ensure any granted access does not introduce security risk.
• Perform security testing for new applications, application updates, and system changes to confirm required controls are in place.
• Review security control systems and related operational workflows to confirm they are run according to security policies.
• Analyze failed or ineffective controls, assess the potential impact, and recommend corrective actions to reduce risk.
• Contribute to process and practice improvements by considering international best practice, business process enhancement, cost reduction, and productivity gains.
• Help prepare accurate and timely reports required by the bank and department.
• Follow safety, quality, and environmental policies and controls to support a healthy and safe workplace.
• Perform other related assignments as instructed within the scope of departmental responsibilities.

Qualifications and experience

The role requires a bachelor’s degree in Computer Science or Information Technology and 2 to 4 years of relevant experience in information security, including areas such as compliance, governance, risk, program management, and operations. English proficiency at an advanced level is required.

Additional information

Employment is full-time and the role is based in Riyadh, Saudi Arabia. The job is listed as remote. No salary, stipend, perks, application deadline, or opening count was specified in the source.