We are seeking an experienced GRC Lead to drive governance, risk, and compliance activities
in Nawy. This role ensures that security risks are identified, assessed, and managed while
maintaining compliance with relevant regulatory and industry standards.
The GRC lead leads the risk governance initiatives, oversees audits, develops policies,
manages security awareness, and partners closely with engineering, product, and legal teams
to ensure secure-by-design operations across the entire organization.
Responsibilities
- Maintain an enterprise-wide information security governance & ISMS framework that
aligns with business objectives, regulatory requirements, and industry best practices.
- Develop, maintain, and enforce security policies, standards, and procedures
- Lead strategic planning initiatives for security risk management, ensuring alignment
with ISO 27001 requirements.
- Design, implement, and manage a security risk management framework that includes
risk assessments, control evaluations, and mitigation strategies.
- Oversee and continuously improve the processes for vendor security risk assessments,
ensuring third-party risks are effectively managed.
- Develop and monitor key risk indicators (KRIs) and performance metrics to evaluate the
effectiveness of security controls and risk mitigation efforts.
- Oversee the development, implementation, and ongoing management of the
organization's security policies.
- Prepare and lead the organization's readiness for external and internal security audits,
including ISO 27001 certification audits.
- Build and run security awareness and phishing simulation programs and promote an
organization-wide culture of security accountability.
- Ensure ongoing compliance with local regulatory frameworks, including those issued by
CBE, FRA, and related bodies.
Requirements
- At least 4 years of experience in GRC, information security risk management or security
compliance roles.
- Certifications: Relevant certifications such as CISSP, CISM, CRISC, or CISA are
preferred.
- Demonstrated experience with ISO 27001 implementation, security audits, and vendor
security risk assessments.
- Solid understanding of cloud architectures and security controls across AWS and
Google Cloud Platform (GCP).
- Familiarity with regulatory requirements in Egypt and international data protection
laws.
- University/college degree in a relevant professional field
- Excellent communication skills in English, both written and spoken
