Nasser Abuhaimed

Cybersecurity GRC Specialist with hands-on experience in regulatory compliance, cybersecurity risk management, audit readiness, and security operations. Deep expertise in conducting gap assessments, control testing, and audit evidence collection against NCA frameworks (ECC, DCC, OSMACC, CCC), ISO/IEC 27001, and SDAIA PDPL. Proven ability to translate regulatory requirements into actionable corrective action plans, maintain risk registers, manage third-party risk (TPRM), and report compliance maturity to senior management through Power BI dashboards.

Background in SIEM monitoring, network traffic analysis, vulnerability management, and ISMS implementation. Adept at stakeholder engagement and supporting organizations in strengthening their overall security posture.

Cybersecurity GRC Specialist at SITE (2026-08 – Present)

• Conducting gap assessments for SAR against the NCA ECC, DCC, TCC, OSMACC frameworks across multiple business functions, mapping existing controls to framework requirements and documenting compliance findings.
• Coordinated the end-to-end stakeholder review and approval process for cybersecurity policies, standards, and procedures, including document circulation, feedback consolidation, comment resolution, revision tracking, and facilitation of final approval and publication.

Cybersecurity GRC Consultant at Resilience (2025-06 – 2026-07)

• Conducted gap assessments for 5+ stakeholder groups at KAFD against 4 NCA frameworks (ECC, DCC, OSMACC, CCC) identifying 35+ compliance findings across governance and defense and third-party domains.
• Performed control testing and audit evidence collection to substantiate compliance posture and support audit readiness across all assessed frameworks.
• Reviewed policies, standards, and third-party vendor contracts to ensure alignment with NCA regulatory requirements and cybersecurity best practices, covering TPRM considerations for 10+ vendor engagements.
• Maintained and updated the cybersecurity risk register, tracking 40+ risks identified by the risk team or escalated through the defense team, ensuring timely corrective action assignment and closure tracking.
• Produced weekly and monthly PowerPoint compliance reports for senior management, summarizing gap assessment findings, risk exposure, and corrective action status across all active NCA framework assessments.
• Built Power BI dashboards to visualize self-assessment results, enabling top management to monitor regulatory compliance maturity in real time across the KAFD engagement.
• Engaged 12+ internal stakeholders and compliance champions to communicate NCA and ISO 27001 control requirements, driving accountability for remediation and maintaining corrective action plans.
• Maintained and tracked cybersecurity GRC project sheets for 15+ active control deployment initiatives, ensuring timely completion and full documentation of evidence.

Network Security Specialist at Marcom Arabia (2023-07 – 2024-10)

• Monitored and analyzed security events across the SIEM platform (ClearSkies), triaging 50+ alerts per week and escalating confirmed incidents for response.
• Captured and analyzed network traffic using Wireshark to support threat hunting and incident investigation activities.
• Conducted vulnerability assessments across the IT infrastructure using Nessus Expert, NMAP, Metasploit, and SQLMapper; identified and prioritized 30+ vulnerabilities for remediation in alignment with NIST SP 800-53 controls.
• Recommended and enforced access control policies for 200+ accounts across systems, remote access, and server environments, aligned with ISO/IEC 27001 and NIST SP 800-53 best practices.
• Conducted periodic reviews and audits of access rights to minimize unauthorized access and maintain compliance with internal control requirements.
• Prepared the organization for NCA ECC compliance (cybersecurity defense domain), coordinating with vendors to deploy required cybersecurity controls and collecting evidence for audit readiness.
• Contributed to ISO/IEC 27001 ISMS implementation including policy development, control recommendations, and compliance readiness activities.
• Supported SDAIA PDPL compliance by aligning internal policies, practices, and data-handling procedures with legal requirements.
• Designed and assisted the delivery of an information security awareness program for 100+ employees, improving policy adherence and phishing awareness.
• Designed network topology and assisted in implementing a DMZ architecture for publicly accessible web servers, reducing the external attack surface.
• Supported asset management by classifying and tracking IT assets to maintain an accurate inventory aligned with cybersecurity standards.
• Administered daily security reviews via Barracuda, Kaspersky, and Sophos security platforms, maintaining a consistent security baseline.

Technical Support Trainee at Saudi Broadcasting Authority (2019-01 – 2019-04)

• Applied software patches and security updates to eliminate vulnerabilities; resolved MS365 and Windows OS issues and performed basic network troubleshooting (VLANs, STP, CDP).

Bachelor of Engineering Technology in Network Technology – College of Telecommunications and Information (2017-01 – 2022-01)