SustainGRC is scaling its Cyber & Resilience suite — Third-Party Risk Management, Cyber Incident Management, Operational Incident Management, Cyber Controls & Assurance, Business Continuity Management, and Regulatory Operations — into UK financial services and GCC enterprise markets.
We're looking for a practitioner who understands how cyber governance, operational resilience, and business continuity intersect in regulated environments. You'll own this from day one: assess platform readiness against regulatory frameworks, take the Cyber & Resilience practice into a market-leading capability — shaping delivery methodology, leading client engagements, and representing SustainGRC in front of CISOs, CROs, and Audit Committees as we scale across UK and GCC markets.
What you'll do
Platform ownership: Assess our Cyber & Resilience modules against FCA/PRA Operational Resilience rules, ISO 27001, ISO 22301, NIST CSF, and DORA. Map controls to UK obligations under PS21/3 and SS1/21, and GCC requirements under SAMA and NCA ECC-2. Produce a Regulatory Alignment Report that becomes the practice's technical baseline.
Practice delivery: Lead clients on cyber risk measurement, incident classification, escalation protocols, and audit trail requirements. Validate client BCM frameworks against regulatory thresholds. Bring technical credibility to pre-sales conversations with CISOs, CROs, and Heads of Operational Resilience. Deliver client-facing workshops on cyber risk governance, operational resilience maturity, and BCM implementation. Own regulatory submissions and compliance assessments end to end.
What we're looking for
Working knowledge of FCA/PRA Operational Resilience requirements, ISO 27001/22301, and NIST CSF — SAMA and NCA ECC-2 familiarity a strong advantage. A background in cyber risk management, operational resilience, incident response, or BCM within financial services or regulated industries. Understanding of how cyber governance intersects with internal audit, third-party risk, and board accountability.
15+ years' relevant experience preferred; strong regulatory foundation and entrepreneurial appetite considered.
Fluent English; Arabic a strong advantage for GCC client-facing engagements.
What matters most: regulatory credibility — you can hold a room with a CISO, Head of Operational Resilience, or Audit Committee — and practical judgement, knowing the difference between compliant on paper and resilient in practice.
Why this role
You're not reviewing a generic cyber tool. You're assessing resilience infrastructure that regulated enterprises will rely on for audit evidence, regulatory submissions, and board accountability. Your feedback shapes the product. Your credibility opens doors.
UK operational resilience enforcement is live. DORA is in force across EU financial entities. The GCC cyber governance landscape — SAMA, NCA ECC-2, SDAIA — is accelerating toward mandatory compliance across regulated sectors. This is precisely where we're deploying.
What we offer
What We Offer
We'll start with a focused 30-minute conversation about your relevant experience and the market.
