Security GRC Engineer (Compliance & Operations)

About the role

The company is looking for a Security GRC Engineer with 3-5 years of experience who can audit a cloud environment as easily as tuning a SIEM alert. As the primary architect of its integrated security framework, the role ensures that security operations meet regulatory obligations (ISO/SOC 2) and moves the organization from manual point-in-time audits to continuous compliance through automation and engineering.

Key responsibilities

• Maintain and evolve the ISMS (ISO 27001 and SOC 2) by building automated evidence-collection pipelines; Gulf compliance and GRC experience is an advantage.
• Lead technical risk assessments and threat modeling sessions, working with engineers to design mitigations and track them in a risk register.
• Audit cloud environments (AWS/GCP/Azure) and enterprise applications against ISO, SOC and NIST standards.
• Advise engineering teams so that new features and deployments follow "Security by Design" and MDM policy requirements.
• Update security policies and technical controls based on incident post-mortems and Blue Team operations.
• Orchestrate the MDM strategy, oversee vulnerability remediation, implement static code analysis and secure note-sharing workflows.
• Oversee data privacy frameworks and controls; Gulf privacy compliance experience is an advantage.

Required profile

• BS in Computer Science, Software Engineering or Cybersecurity.
• Hands-on experience scaling SOC 2, ISO 27001 and ISO 27701 in a modern tech stack.
• 2+ years in high-pressure incident response environments.
• Ability to explain complex compliance requirements to DevOps and product teams.
• Experience running security awareness and onboarding training.
• Proficiency in automating GRC workflows with AI.
• Must have exposure to GDPR, NIST 800-53, ISO 27701 and PDPL; good to have HIPAA, PCI DSS, FERPA, NCA, NIA, SAMA AI Risk Management (ISO 42001), EDR, CSPM and Zero Trust.

Required skills

• SIEM customization (Wazuh, ELK, QRadar, Panther) to reduce false positives.
• ISO 27001 Lead Implementer or Auditor certification.
• Security+, CHFI, CEH or another SOC-related certification; CISA, CISM, CISSP listed as nice to have.