IT Project Governance Expert

IOTA's Talent & Managed Solutions practice places senior specialists inside our clients — banks, financial institutions and enterprises across the Kingdom — to do work their own teams are not staffed for. This role is one of those placements, and you go in as the person who owns IT governance.

Most organisations do not lack process; they lack process anyone follows. You will likely inherit some combination of a steering committee that rubber-stamps, a project register nobody trusts, stage gates passed retrospectively, and an audit finding that has been open for two years. Your job is to replace that with a governance framework that holds — tailored to the organisation in front of you rather than lifted whole out of COBIT, and light enough that delivery teams stop working around it.

This is an advisory role with accountability attached. You will sit in front of executive committees, internal audit and, where the client is regulated, the regulator's inspection team — and what you report has to be true.

What you'll do

• Assess the client's current governance against COBIT 2019 and the applicable regulatory expectations, and report honestly on what works, what is theatre, and what is a finding waiting to happen
• Design the target governance framework — governance objectives, decision rights, policies, standards and the processes connecting them — tailored using COBIT design factors rather than adopted wholesale
• Stand up and run the governance machinery: steering committees, portfolio and investment boards, stage gates, and an escalation path that makes a red programme visible before it fails
• Define the project and programme delivery standard — lifecycle, gate criteria, artefacts, RAID management and change control — and make it workable for both waterfall and agile delivery
• Build the portfolio view: what is in flight, what it costs, what it depends on, and whether it is delivering the benefits it was approved for
• Design IT risk and control structures, run control testing, and close audit findings so that they stay closed
• Align the framework with SAMA expectations on IT governance, risk and business continuity, NCA controls, and NDMO and PDPL obligations on data ownership, classification and retention
• Set up benefits realisation and post-implementation review, so the organisation learns whether an investment actually worked
• Govern third parties — SLAs, service reviews, and holding systems integrators to what they contracted to deliver
• Establish or rebuild the PMO, and train the people who will run it
• Report to the executive committee and the board: a small number of honest measures and a clear view of portfolio risk
• Hand over properly — documented framework, approved policies, trained staff, and a PMO that still works after you leave

How the role works

• On-site with the client in Riyadh, embedded in their governance and PMO functions
• Part of IOTA's Talent & Managed Solutions practice, with our architects and practice leads behind you
• Occasional travel to client sites within the Kingdom
• Starting as soon as possible

What we offer

• Competitive salary, reviewed annually
• A mandate to design governance rather than administer someone else's
• Executive and board-level exposure inside regulated organisations from your first weeks
• The backing of IOTA's other practices — Digital Engineering, Data & AI, Cybersecurity, and IT Infra, Cloud & DevOps — when a governance problem turns out to be a technical one

What we're looking for

• 8+ years in IT governance, PMO or programme assurance, with at least 3 years designing or owning a governance framework rather than working inside someone else's
• Deep working knowledge of COBIT 2019 — design factors, governance and management objectives, and how to tailor it to an organisation instead of adopting it wholesale
• Hands-on with at least one delivery framework — PMI/PMBOK, PRINCE2 or a scaled agile equivalent — and the judgement to say which parts a given programme actually needs
• Designing and running the governance machinery: steering committees, stage gates, investment approval, RAID and escalation paths, and benefits realisation after go-live
• IT risk and control design — control objectives, risk registers, control testing, and closing audit findings so that they stay closed
• Portfolio and programme reporting an executive committee will act on: a small number of honest measures, not a dashboard nobody reads
• Vendor and third-party governance — SLAs, service reviews, and holding a systems integrator to its contract
• Policy and process authoring: writing the standard, getting it approved, and making it stick across teams that did not ask for it
• Comfortable in front of an audit committee, an internal auditor and a regulator's inspection team
• A degree in Computer Science, Information Systems, Engineering, Business or a related field, or equivalent experience
• Professional English, written and spoken; Arabic is a strong advantage for committee and regulator work
• Based in or willing to relocate to Riyadh; eligible to work in Saudi Arabia

Banking and financial services

Preferable, not a requirement. If you bring it, we would expect familiarity with:

• SAMA expectations on IT governance, cyber security and business continuity — and what an inspection actually asks to see
• NCA Essential Cybersecurity Controls, and NDMO and PDPL obligations on data ownership, classification and retention
• Core banking, payments or lending programmes, and the change control that sits around a production banking estate

Nice to have

• Certification — CGEIT, COBIT, PMP, PRINCE2, CRISC, CISA or ITIL 4 — and working practice with ISO/IEC 38500 and ISO/IEC 27001
• Standing up a PMO from nothing, and owning the first year of running it
• Portfolio and service tooling: Microsoft Project Online, Jira, ServiceNow SPM or Clarity PPM, including the reporting layer on top
• Governance of data and AI programmes, where the controls are still being written
• Time inside a bank, a regulator, or a consultancy serving them in the GCC

How you work

• You design governance that makes delivery faster rather than taxing it, and you can tell the difference
• Direct in a steering committee — you report a programme as red when it is red
• Clear with executives and engineers alike, and you write well enough that your documents outlast you
• Patient with people who see governance as overhead, and persuasive enough to change their minds