Education & Experience:
Bachelor's degree in information technology, Computer Science, Cybersecurity.
A master's degree in Cybersecurity, Risk Management, or Information Security is a plus.
Minimum 5-7 years of experience in IT/cybersecurity risk management, information security, or IT audit, preferably within the telecom or technology sector.
Proven track record in conducting risk assessments across IT project lifecycles (design to launch) and on operational/production systems.
Experience building and maintaining organizational risk registers and reporting to senior management/governance committees.
Prior exposure to regulatory compliance and audit processes within Jordan or the MENA region is preferred.
Strong knowledge of Jordanian regulatory and cybersecurity frameworks, including the National Cybersecurity Framework (NCSC) issued by the National Cybersecurity Center of Jordan, and the Jordan Data Protection Law (JDPL).
Solid understanding of international cybersecurity and risk frameworks such as ISO/IEC 27001, NIST Cybersecurity Framework (CSF).
Familiarity with IT & Telecom-specific security standards and best practices, including GSMA security guidelines, ITU-T security recommendations, and TM Forum frameworks, where applicable.
Working knowledge of risk assessment methodologies (qualitative and quantitative), threat modeling, and vulnerability management processes.
Awareness of data privacy and protection principles as they intersect with cybersecurity risk (e.g., GDPR concepts, as a reference alongside JDPL).
Understanding of business continuity, disaster recovery, and incident response principles as they relate to risk mitigation.
Key Accountabilities:
Conduct comprehensive risk assessments on all IT/DevOps/Telcom projects from the design phase through launch, ensuring security and risk considerations are embedded early to prevent costly rework and post-deployment vulnerabilities.
Perform periodic risk assessments on existing, already-implemented systems and solutions, so that evolving threats and control gaps are identified before they can be exploited.
Develop and maintain a centralized, up-to-date risk register for the organization, giving leadership accurate visibility to prioritize resources and make informed risk-based decisions.
Execute regular, scheduled risk assessment cycles and audits, ensuring risk management remains a continuous discipline rather than a one-time exercise.
Translate identified risks into clear, actionable mitigation plans with defined owners and timelines, ensuring accountability and timely closure of vulnerabilities.
Collaborate with all stockholders to embed risk controls into workflows, reducing the likelihood of security incidents disrupting operations.
Monitor compliance with internal security policies and relevant regulatory standards, protecting the organization from legal, financial, and reputational exposure.
Report risk status, trends, and emerging threats to senior management, enabling proactive governance and strengthening the organization's overall cybersecurity resilience.
