Senior Manager - Third Party Security
Lead and manage Qiddiya's Third-Party Security Risk Management program to ensure vendors, partners, consultants, and service providers comply with cybersecurity requirements and do not introduce unacceptable risks to Qiddiya's information assets, systems, and operations. The role is responsible for establishing security assessment frameworks, overseeing vendor security reviews, and driving remediation of identified risks. This aligns with industry practices for cybersecurity risk management and third-party oversight.
Key Responsibilities
- Develop and maintain the Third-Party Security Risk Management (TPSRM) framework.
- Conduct cybersecurity due diligence and risk assessments for vendors and suppliers.
- Review security requirements during procurement, RFP, and contract stages.
- Assess cloud providers, SaaS platforms, managed service providers, and strategic partners.
- Define vendor security controls aligned with NCA ECC, ISO 27001, NIST, and Qiddiya cybersecurity standards.
- Establish vendor risk classification and assessment methodologies.
- Monitor remediation plans and track closure of identified security gaps.
- Collaborate with Procurement, Legal, Compliance, Enterprise Risk, and Technology teams.
- Lead periodic reassessments of critical vendors.
- Report third-party cyber risks, trends, and KPIs to senior management.
- Manage external security audits, questionnaires, and assurance activities.
- Lead and develop the Third-Party Security team.
Requirements
- Bachelor's degree in Cybersecurity, Information Security, Computer Science, or related field.
- 8–12 years of cybersecurity experience.
- Minimum 4 years in Third-Party Security, Vendor Risk Management, Cybersecurity Risk Management, or GRC.
- Experience within large enterprises, giga projects, banking, telecom, government, or critical infrastructure environments.
- Experience managing teams and stakeholder engagement at senior levels.
Skills
As published by workable
First name, Last name, Email, Phone, Highest Education Level, Gender, Do you, or any immediate family member or close personal associate, have any actual, potential, or perceived conflict of interest in relation to QIC, arising from personal relationships, financial interests, or external employment, business activities, or services, that could reasonably be perceived as influencing your independence, objectivity, or decision-making if employed by QIC?, Are you currently or have you ever worked directly for PIF or one of its affiliated companies?, Current Location, Date of Birth, Expected Salary, Current monthly salary, Nationality Field, Resume, Years of relevant experience, Are you currently involved or working directly for Qiddiya either through a delivery partner or as a consultant?, By proceeding, I acknowledge that I have read the Privacy Notice https://qiddiya.com/en/careers/career-privacy-notice/ and consent to the use of my personal data provided in my job application for the purpose of conducting the recruitment process with Qiddiya Investment Company. I confirm that all information submitted as part of my job application is complete, accurate, and true to the best of my knowledge. I understand that providing false, misleading, or incomplete information at any stage of the application or profile creation process may result in the rejection of my application. I further acknowledge and agree that Qiddiya Investment Company may verify the information I have provided, either directly or through authorized third parties., I hereby confirm that I have never had any criminal conviction, an arrest or charge for which I am currently on or awaiting trial