Director of Information Security (Saudi Only)

Lucidya is an AI-native Customer Experience Management platform that helps organizations understand, engage, and serve their customers at scale. Our platform brings together customer intelligence, omnichannel engagement, and agentic AI so teams can turn customer insight into meaningful action.

As we grow across enterprise and government markets in the region, protecting customer data and earning trust are central to how we build products and run our business.

We are hiring a Director of Information Security to lead and scale Lucidya’s security function across our products, cloud infrastructure, corporate environment, and compliance programs.

Reporting directly to the Chief Technology Officer, you will own the security roadmap, build and lead the security team, and partner with Engineering, Product, SRE, DevOps, IT, Legal, People, Sales, and Customer Experience.

This is a hands-on leadership role. One day you might be reviewing an architecture design or leading an incident response; the next, walking an auditor through our controls or explaining our security posture to a government customer. Your job is to turn security requirements into practical controls, clear ownership, and measurable progress.

Security Leadership and Governance

• →Define and execute Lucidya’s security strategy and roadmap, aligned with business priorities and customer commitments.
• →Lead, mentor, and grow the security team with clear responsibilities and development plans.
• →Drive agentic transformation across the team’s operations, applying AI agents to work such as alert triage, evidence collection, vulnerability management, and security questionnaires.
• →Own security policies, standards, risk assessments, and the risk register, including processes for exceptions, risk acceptance, and escalation.
• →Manage security tooling, service providers, and budget, and report posture, risks, and incidents to executive leadership.

Compliance and Audit Readiness

• →Lead the implementation and maintenance of controls for Saudi PDPL, NCA, ISO 27001, SOC 2, and other relevant frameworks.
• →Maintain the Information Security Management System and coordinate control ownership across departments.
• →Keep audit evidence accurate and ready, manage audit preparation and findings, and verify that documented controls actually operate effectively.
• →Partner with Legal on data protection, retention, access, and contractual security requirements.

Product, Application, and Cloud Security

• →Embed security into architecture, development, testing, and deployment, including automated scanning of code, dependencies, secrets, containers, and infrastructure.
• →Define release security criteria, remediation timelines, and exception processes.
• →Lead threat modeling and security reviews for major product changes, integrations, and AI capabilities.
• →Oversee penetration testing, adversarial testing, and vulnerability assessments through to verified resolution.
• →Review security across AWS and GCP (identity, privileged access, networking, encryption, secrets, logging) and maintain visibility over internet-facing assets.

Corporate Security and Awareness

• →Set security requirements for employee devices, identities, and internal applications, and work with IT to implement and verify them.
• →Oversee access reviews across onboarding, role changes, and offboarding.
• →Run security awareness training, phishing exercises, and targeted education for technical and business teams.
• →Assess the security risk of third-party tools and vendors handling company or customer data.
• →Define and verify network and physical security standards for our office site.

Security Operations and Incident Response

• →Own the security operations model, including internal responsibilities, external SOC/MDR providers, monitoring coverage, and after-hours escalation.
• →Oversee log collection, detection, alert triage, and investigation across cloud, application, identity, endpoint, and network.
• →Maintain incident response plans and playbooks, lead incident coordination and post-incident reviews, and run regular simulations.
• →Work with Legal, leadership, and customer teams on timely, accurate notifications when incidents affect customers.

Customer Trust and Vulnerability Disclosure

• →Manage Lucidya’s vulnerability disclosure program from researcher contact through closure.
• →Support Sales and Customer Experience with security questionnaires, assessments, and technical discussions, backed by approved, reusable assurance materials.
• →Review proposed customer security commitments to make sure they’re accurate and achievable.
• →Serve as the primary security contact for auditors, testing providers, and customer security teams.

• 8+ years of progressive experience in information security, including at least 3 years leading security teams or programs.
• Experience securing a SaaS platform or comparable cloud-based software environment.
• A track record spanning both technical security and governance, risk, and compliance.
• Hands-on experience implementing ISO 27001 and SOC 2 controls, including direct involvement in external audits.
• Practical familiarity with Saudi PDPL and NCA requirements, and the ability to translate them into technical controls and evidence.
• Experience leading investigations, incident response, and vulnerability remediation across multiple teams.
• Bachelor’s degree in cybersecurity, computer science, IT, or a related field, or equivalent practical experience.

• Strong grasp of application and API security, secure development practices, and common vulnerability classes.
• Practical experience with CI/CD security controls: code, dependency, container, secret, and infrastructure scanning.
• Strong AWS, Azure or GCP security knowledge, with the ability to oversee controls across both.
• Familiarity with Kubernetes, containers, infrastructure as code, and modern deployment architectures.
• Experience with SIEM, cloud security monitoring, endpoint protection, identity management, and vulnerability management tools.
• Ability to automate security and evidence-collection work, with hands-on experience applying AI agents or LLM-based tooling to security operations.

• Proven ability to build accountable teams and drive improvement across departments.
• Sound judgment when balancing security risk, delivery needs, and customer commitments.
• Clear communication with engineers, executives, auditors, and customers alike.
• Strong ownership, including following through until corrective actions are verified complete.