Job Title: Incident Management & Response Senior Manager
Division: Cyber Security - Risk
Location: Riyadh
Working Hours: 8:00 AM to 5:00 PM (Sunday to Thursday)
Core Responsibilities
- Lead an incident management and response team capable of handling multiple security incidents, minimizing further risk to SAB's information assets and services.
- Manage the full Cybersecurity Incident Response lifecycle (preparation, detection, analysis, containment, eradication, recovery, and post-incident activities).
- Maintain and continuously refine the Cybersecurity Incident Response Plan, playbooks, SLAs, and communication protocols.
- Ensure alignment with regulatory cybersecurity frameworks (e.g. SAMA and NCA), internal policies and standards.
- Oversee triage, prioritization, and response to cybersecurity alerts and incidents in coordination with SOC teams (CITA and MTD), Infrastructure Security, Application Security, and IT teams.
- Ensure accurate, timely incident classification, escalation, impact assessment, and documentation.
- Lead containment and remediation strategies for complex or high-impact incidents.
- Act as the primary escalation point for cybersecurity incidents, ensuring structured coordination across Cybersecurity, IT, Business, Legal, Compliance, and Communications as required.
- Facilitate executive-level and regulator-level updates during critical events.
- Ensure incident learnings feed directly into tuning SIEM/SOAR, EDR and other defensive technologies.
- Oversee threat-informed response enhancements based on threat intelligence and the threat profile of the bank.
- Plan and run tabletop exercises and playbook validation tests. Ensure lessons learned are documented, prioritized, and incorporated into processes and tooling.
- Drive bank-wide readiness for ransomware, cloud security incidents, and third-party compromise scenarios.
- Maintain all incident records, evidence, timelines, and reports in accordance with internal policies and regulatory expectations (SAMA, NCA, etc.).
- Ensure timely regulatory notifications and responses where required.
- Oversee the effective use of SOAR, case management platforms, incident tracking systems, and forensic tools.
Qualifications/Years of Experience:
- Bachelor's degree in Computer Science, Information Security or any equivalent major.
- Around 8-10 years of relevant experience with at least 5 years in a similar role.
- Experience in an enterprise scale organization; preferably in the finance or similarly regulated sector
