Chief Information Security Officer

About The Role

Role Summary:

The Chief Information Security Officer (CISO) is responsible for leading Soar’s information security strategy, cybersecurity governance, risk management, and regulatory compliance. The role ensures the confidentiality, integrity, and availability of the company’s information assets, systems, and customer data while supporting business growth and operational resilience.

The CISO will establish and maintain a robust information security framework aligned with Saudi Central Bank (SAMA) requirements, the National Cybersecurity Authority (NCA) controls, and applicable cybersecurity standards and regulations.

Key Responsibilities:

1- Information Security Strategy & Governance

• Develop, implement, and maintain Soar’s information security strategy, policies, standards, and procedures.
• Establish an effective information security governance framework aligned with business objectives and regulatory requirements.
• Advise the CEO and senior management on cybersecurity risks, emerging threats, and security priorities.
• Report on the company’s information security posture, key risks, and remediation progress to executive management and relevant governance committees.
  
  

2- Regulatory Compliance & Audit

• Ensure compliance with applicable SAMA Cyber Security Framework (CSF), NCA cybersecurity controls, and other relevant regulatory requirements.
• Lead cybersecurity assessments, control implementation, evidence collection, and remediation activities related to regulatory examinations and independent audits.
• Coordinate with internal audit, external auditors, regulators, and third-party cybersecurity service providers.
• Monitor regulatory updates and ensure timely implementation of applicable security requirements.
• Maintain accurate documentation of security controls, risk assessments, exceptions, and remediation plans.
  
  

3- Cybersecurity Risk Management

• Identify, assess, prioritize, and manage information security and cyber risks across the organization.
• Maintain the information security risk register and oversee risk mitigation plans.
• Conduct periodic risk assessments, vulnerability assessments, penetration tests, and security reviews.
• Evaluate the security risks associated with third-party vendors, cloud services, outsourced operations, and technology integrations.
• Ensure that security risks are appropriately escalated and accepted only by authorized risk owners.
  
  

4- Security Operations & Incident Responses

• Oversee security monitoring, threat detection, vulnerability management, and incident response capabilities.
• Ensure effective operation of the Security Operations Center (SOC), SIEM, endpoint protection, and other security monitoring solutions.
• Establish and maintain incident response, escalation, investigation, and reporting procedures.
• Lead the organization’s response to significant cybersecurity incidents and coordinate containment, recovery, root-cause analysis, and lessons learned.
• Ensure timely escalation and regulatory notification of incidents where required.
  
  

5- Identity & Access Management

• Establish and enforce identity and access management policies, including least-privilege access and segregation of duties.
• Oversee privileged access management, multi-factor authentication, access reviews, and secure remote access.
• Ensure appropriate controls for production environments, administrative accounts, and sensitive customer information.
• Review and monitor access granted to employees, contractors, and third-party service providers.
  
  

6- Cloud, Infrastructure & Application Security

• Define and oversee security requirements for cloud infrastructure, networks, endpoints, databases, and production systems.
• Integrate security controls into the software development lifecycle and CI/CD pipelines.
• Ensure secure configuration management, encryption, secrets management, logging, and vulnerability remediation.
• Work closely with the CTO, engineering, DevOps, and IT teams to embed security into system design, development, deployment, and operations.
• Oversee security reviews of APIs, integrations, and critical business applications.
  
  

7- Business Continuity & Cyber Resilience

• Work with IT and business continuity teams to ensure cybersecurity requirements are integrated into business continuity and disaster recovery plans.
• Oversee cyber recovery preparedness, backup security, recovery testing, and resilience assessments.
• Participate in disaster recovery exercises and ensure that identified security gaps are addressed.
• Support the organization’s ability to maintain or restore critical services following cyber incidents or technology disruptions.
  
  

8- Data Protection & Customer Security

• Establish appropriate controls to protect confidential information, personal data, financial information, and customer records.
• Ensure security requirements are integrated into data classification, retention, transmission, and disposal processes.
• Coordinate with relevant stakeholders to address data protection obligations and security-related customer concerns.
• Promote secure handling of customer information across all systems and business processes.
  
  

9- Third Party & Outsourcing Security

• Assess and monitor cybersecurity risks associated with outsourced services, cloud providers, managed security providers, and technology vendors.
• Review security clauses, service-level agreements, incident notification obligations, and audit rights in relevant contracts.
• Ensure third-party access to Soar’s systems and data is appropriately authorized, restricted, monitored, and periodically reviewed.
  
  

10- Security Awareness & Culture

• Develop and deliver cybersecurity awareness and training programs for employees and contractors.
• Promote a security-first culture across the organization.
• Provide specialized guidance to teams handling sensitive data, privileged access, and critical financial operations.
  
  

Key Performance Indicators (KPIs):

• Compliance status against applicable SAMA CSF and NCA requirements.
• Percentage of cybersecurity control gaps remediated within agreed deadlines.
• Number and severity of unresolved critical vulnerabilities.
• Mean time to detect, respond to, and contain security incidents.
• Completion rate of privileged access reviews and access recertification.
• Security incident response and regulatory reporting timeliness.
• Completion and effectiveness of disaster recovery and cyber resilience exercises.
• Third-party security assessment coverage and remediation performance.
• Employee cybersecurity awareness and training completion rates.
  
  

Requirements

Qualifications & Experience :

• Bachelor’s degree in Cybersecurity, Information Security, Computer Science, Information Technology, or a related field.
• Typically 8–12+ years of experience in cybersecurity or information security, including significant leadership experience.
• Demonstrated experience implementing and maintaining cybersecurity frameworks in a regulated financial institution or fintech environment.
• Strong knowledge of SAMA CSF, NCA cybersecurity controls, ISO 27001, NIST Cybersecurity Framework, and cloud security principles.
• Experience with SOC operations, SIEM platforms, incident response, IAM/PAM, vulnerability management, and third-party risk management.
• Proven ability to manage regulatory examinations, cybersecurity audits, and remediation programs.
• Excellent leadership, communication, risk management, and stakeholder management skills.
  
  

Preferred Certifications:

• CISSP
• CISM
• CISA
• CCSP
• CRISC
• ISO 27001 Lead Implementer or Lead Auditor
  
  

Reporting & Collaboration:

• Reports to: CEO or another designated executive, in accordance with Soar’s approved governance structure.
• Key stakeholders: Board and relevant committees, executive management, Risk, Compliance, Internal Audit, CTO, IT, Engineering, DevOps, Legal, and external cybersecurity service providers.
• Independence: The role should have appropriate authority, access, and independence to escalate significant cybersecurity risks and report material concerns to the appropriate governance body.
  
  

Important Governance Note:

The CISO is responsible for information security governance and oversight. Technology and engineering teams remain responsible for implementing and operating the security controls assigned to them. Internal Audit should independently assess the effectiveness of information security controls without assuming operational responsibility for them.

Final alignment note: The job description should be aligned with Soar’s approved organizational structure, applicable SAMA requirements, cybersecurity independence expectations, and any specific regulatory requirements for appointment or qualifications. The certifications and experience listed above are suggested preferences and should not be interpreted as mandatory SAMA requirements unless separately confirmed.