Lead Anti-Fraud Officer

About the Position

We are seeking a Lead Anti-Fraud Officer to independently lead complex governance, risk, and compliance activities in our fintech company in Riyadh, Saudi Arabia. The role serves as a subject matter expert in one or more GRC domains, including enterprise information security governance, risk management frameworks, regulatory compliance, or third-party risk management.

Responsibilities

• Governance and Compliance:

  • Lead the development, review, and continuous improvement of information security policies, standards, procedures, and governance frameworks.
  • Serve as the subject matter expert for assigned regulatory domains, providing authoritative interpretation of requirements and translating them into implementable control objectives.
  • Monitor and proactively track regulatory and legal developments affecting information security, assessing impact and recommending updates to the governance framework.
  • Prepare and review governance documentation, including RACI matrices, security charter updates, and governance committee packs, and present findings to senior stakeholders.
  • Lead the preparation of regulatory self-assessments and compliance attestations, coordinating evidence gathering and quality-reviewing submissions before senior sign-off.
  • Mentor GR1–GR2 team members on governance documentation quality, regulatory interpretation, and risk assessment methodology.

• Enterprise Risk Management:

  • Lead the execution of complex enterprise information security risk assessments, applying advanced qualitative and quantitative methodologies to produce risk profiles aligned with the organization's risk appetite.
  • Own and maintain the enterprise information security risk register, ensuring accuracy, currency, and appropriate escalation of significant risks.
  • Lead BIA processes for critical business functions, coordinating with asset owners, analyzing recovery requirements, and producing BIA outputs for Business Continuity and Disaster Recovery planning.
  • Design and execute control effectiveness testing programs, producing findings reports with gap analysis and risk-ranked remediation recommendations.
  • Lead third-party information security risk management, designing assessment frameworks, conducting in-depth vendor reviews, and maintaining the third-party risk register.
  • Produce executive-quality risk reporting with trend analysis, emerging risk identification, and treatment progress tracking for senior management and committee consumption.

• Compliance Programme Delivery:

  • Lead compliance monitoring activities for CFFR, NCA ECC, PDPL, ISO 27001, and PCI-DSS, producing gap analyses, treatment plans, and periodic compliance status reports.
  • Manage internal and external audit cycles, coordinating evidence collection, reviewing evidence quality, engaging with auditors, and tracking remediation to closure.
  • Design and deliver the security awareness program, producing targeted content for different staff segments, conducting awareness sessions, and analyzing effectiveness metrics.
  • Develop and maintain GRC program metrics dashboards, ensuring KPIs and KRIs are accurately measured and presented to senior management on schedule.
  • Lead the integration of information security requirements into third-party contracts, procurement processes, and major project onboarding.
  • Contribute to the development of the information security program strategy, identifying capability improvement opportunities and recommending investment priorities to the Lead.

• Cross-Functional Collaboration & Knowledge Leadership:

  • Serve as the primary GRC point of contact for assigned business and technology teams, providing expert guidance on security requirements, risk treatment, and compliance obligations.
  • Lead information classification and security requirements reviews for significant IT, product, and business projects.
  • Contribute to the GRC knowledge base, developing reusable templates, guidance documents, and training materials for internal use.
  • Represent the GRC function in cross-functional working groups, project steering committees, and regulatory workstreams.
  • Perform additional responsibilities as assigned by management.

Requirements

• Bachelor's degree in Information Technology, Computer Science, Software Engineering, Cybersecurity, Risk Management, or a related field.
• A Master's degree in Information Security, Risk Management, or Business Administration is an advantage.
• 3–5 years of progressive professional experience in information security governance, risk management, or compliance. Demonstrable experience independently leading risk assessment cycles, regulatory compliance programs, or audit coordination activities.
• In-depth knowledge of the CFFR framework is required.
• Experience in a regulated Fintech or banking environment is strongly preferred.

We Offer

• Inclusive company culture, embracing diversity, integrity, and transparency.
• 100% trust and freedom to apply your own vision and come up with your ideas from day 1 at Tabby.
• Opportunity to learn and grow in one of the fastest-growing fintech companies in the region.
• Relocation support and guidance through the entire process.
• Devices required for your work will be provided.

About Tabby

Tabby creates financial freedom in the way people shop, earn, and save, by reshaping their relationship with money. The company’s flagship offering allows shoppers to split their payments online and in-store with no interest or fees. Over 32,000 global brands and small businesses, including Amazon, Noon, IKEA, and Shein use Tabby to accelerate growth and gain loyal customers by offering easy and flexible payments online and in stores.

Tabby has generated over $7 billion in transaction volume for its partner brands and has the highest-rated, most reviewed, largest, and fastest-growing app of any fintech in the GCC region. Tabby launched operations in 2020 and has raised +$1 billion in equity and debt funding from global and regional investors.

Apply Now

Apply Now

Register Your Interest

Our Hiring Process

1. Applied
2. Review
3. HR call @Tabby
4. Technical interview @Tabby

Not quite right? Register your interest to be notified of any roles that come along that meet your criteria.

Register Your Interest

Apply Now

Job Details

• Department: Risk B2C
• Employment Type: Full Time
• Location: KSA
• Workplace type: Onsite
• Reporting To: [email protected]

View all opportunities at Tabby