Cybersecurity Controls Specialist (SMC) - Saudi National

About the role

You make sure the security controls protecting Saudi Arabia's large enterprises and government entities actually work. You build them, test them and prove them against NCA ECC, SAMA and ISO 27001. The programmes you join are large transformations with real national weight. Müller's Solutions is a Berlin-headquartered technology consulting and managed-services firm. Our Middle East hub is in Riyadh, with offices in Dubai, Cairo and Casablanca. We partner with SAP, ServiceNow, OpenText, Red Hat, Boomi and BMC Helix. We also fund the certifications that move your career forward. What you'll do • Own the cybersecurity controls library and map it to NCA ECC, SAMA Cybersecurity Framework, ISO 27001, NIST CSF and PDPL. • Plan and run control testing and security audits, and track every finding to closure. • Run risk assessments for client programmes and agree practical treatment plans with system owners. • Write and maintain security policies, standards and procedures that teams can follow in daily work. • Coordinate with SOC, IAM, network, endpoint and cloud teams to confirm that SIEM, EDR, PAM, firewall and vulnerability management controls are configured and effective. • Support incident response by checking playbooks, joining major incident reviews and driving corrective actions. • Assess third-party and vendor security risk, and set the security requirements that go into contracts. • Build security metrics and KPI reports that executives and regulators can read at a glance. • Run security awareness activities, and check that business continuity and disaster recovery plans are tested.

What you need

• 5+ years of hands-on experience in cybersecurity controls, GRC, security operations or security audit.
• Working knowledge of NCA ECC (including ECC-2:2024) and delivery experience with at least one more framework: SAMA CSF, ISO 27001:2022, NIST CSF or PDPL.
• Proven experience designing, testing and evidencing controls through audits or regulatory assessments.
• Practical experience with SIEM (for example Splunk, Microsoft Sentinel or QRadar) and vulnerability management tools (for example Tenable or Qualys).
• Solid understanding of IAM and PAM, endpoint security and EDR, and network security including firewalls.
• Experience with cloud security controls on AWS, Azure or Google Cloud.
• Experience running risk assessments and third-party security reviews.
• At least one recognised certification, such as CISSP, CISM, CISA, CRISC or ISO 27001 Lead Implementer or Lead Auditor.
• Strong stakeholder management skills, with the ability to explain technical risk to non-technical leaders.
• Professional working proficiency in Arabic and English, written and spoken.
• Nice to have: Experience on government or regulated-sector engagements in Saudi Arabia or the wider Gulf.
• Nice to have: Experience with GRC or ITSM platforms such as ServiceNow GRC or similar.
• Nice to have: Business continuity or disaster recovery certification or delivery experience, for example ISO 22301.
• Nice to have: Hands-on administration of security tools such as CyberArk, CrowdStrike or Microsoft Defender.
• Nice to have: Experience in a consulting or managed-services environment with several clients at once.

What we offer

• Competitive compensation package.
• Tax-free salary.
• Medical insurance.
• A clear career path across a growing regional and international firm.
• Enterprise and government projects that build a strong portfolio.
• Work alongside experts in SAP, ServiceNow, OpenText, Red Hat, Boomi and BMC Helix.