Security Risk Expert

Education & Experience:

• Bachelor's degree in information technology, Computer Science, Cybersecurity.

• A master's degree in Cybersecurity, Risk Management, or Information Security is a plus.

• Minimum 5-7 years of experience in IT/cybersecurity risk management, information security, or IT audit, preferably within the telecom or technology sector.

• Proven track record in conducting risk assessments across IT project lifecycles (design to launch) and on operational/production systems.

• Experience building and maintaining organizational risk registers and reporting to senior management/governance committees.

• Prior exposure to regulatory compliance and audit processes within Jordan or the MENA region is preferred.

• Strong knowledge of Jordanian regulatory and cybersecurity frameworks, including the National Cybersecurity Framework (NCSC) issued by the National Cybersecurity Center of Jordan, and the Jordan Data Protection Law (JDPL).

• Solid understanding of international cybersecurity and risk frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework (CSF).

• Familiarity with IT & Telecom-specific security standards and best practices, including GSMA security guidelines, ITU-T security recommendations, and TM Forum frameworks, where applicable.

• Working knowledge of risk assessment methodologies (qualitative and quantitative), threat modeling, and vulnerability management processes.

• Awareness of data privacy and protection principles as they intersect with cybersecurity risk (e.g., GDPR concepts, as a reference alongside JDPL).

• Understanding of business continuity, disaster recovery, and incident response principles as they relate to risk mitigation.

Key Accountabilities:

• Conduct comprehensive risk assessments on all IT/DevOps/Telcom projects from the design phase through launch, ensuring security and risk considerations are embedded early to prevent costly rework and post-deployment vulnerabilities.

• Perform periodic risk assessments on existing, already-implemented systems and solutions, so that evolving threats and control gaps are identified before they can be exploited.

• Develop and maintain a centralized, up-to-date risk register for the organization, giving leadership accurate visibility to prioritize resources and make informed risk-based decisions.

• Execute regular, scheduled risk assessment cycles and audits, ensuring risk management remains a continuous discipline rather than a one-time exercise.

• Translate identified risks into clear, actionable mitigation plans with defined owners and timelines, ensuring accountability and timely closure of vulnerabilities.

• Collaborate with all stockholders to embed risk controls into workflows, reducing the likelihood of security incidents disrupting operations.

• Monitor compliance with internal security policies and relevant regulatory standards, protecting the organization from legal, financial, and reputational exposure.

• Report risk status, trends, and emerging threats to senior management, enabling proactive governance and strengthening the organization's overall cybersecurity resilience.