ABDULELAH ALABBADY

General Court of Audit is Saudi Arabia’s Supreme Audit Institution (SAI)

• Led and scaled a team of 20+ cybersecurity professionals to design and implement a robust, risk-driven, and process-integrated cybersecurity function during a full-scale digital and business transformation.
• Established and operationalized NCA-Compliant NIST-aligned System Security Engineering and Risk Management frameworks, reducing strategic and tactical cybersecurity KRIs by over 90% through risk-driven controls and system-level enforcement mechanisms.
• Directed Cybersecurity compliance programs, achieving over 120% improvement in compliance coverage and control effectiveness across multiple regulatory and security frameworks.
• Optimized cybersecurity investment returns by introducing automation and control optimization initiatives, reducing exposure to cyber threats by more than 70%.
• Contributed to the establishment of core functions including Enterprise Risk Management, enterprise Business Continuity, infrastructure modernization, and organization-wide digital transformation programs
• Acted as the final technical authority for security design decisions and implementation of security controls across Nationally critical systems.

Cyberani Solutions (Joint Venture of Aramco & Raytheon Technologies)

• Led delivery of cybersecurity risk management workstreams for key enterprise and critical-infrastructure clients, acting as primary delivery lead across multiple engagements.
• Directed comprehensive cybersecurity risk and architectural assessments across organizational processes, technology platforms, and system designs, delivering actionable, executive-ready outputs.
• Provided technical assurance for secure software delivery, including assessment of DevSecOps programs, CI/CD pipelines, and secure deployment practices in collaboration with application teams.
• Conducted third-party security and compliance reviews for suppliers supporting critical programs, including evaluations against Aramco control and assurance requirements.

Saudi Payments (SAMA – Saudi Central Bank National Payments Operator)

• Led cybersecurity risk management activities for Saudi Arabia’s national payments infrastructure, supporting payment schemes and settlement systems operating at national scale.
• Conducted strategic cyber risk framing and threat research across global, regional, and sectoral contexts, presenting risk insights and priorities to executive leadership.
• Developed and maintained cybersecurity risk management processes aligned with NIST RMF, performing risk assessments and driving remediation planning for critical systems.
• Monitored enterprise risk posture through validation of remediation actions and closure evidence, strengthening risk governance and accountability.

• Supported the CISO office in cybersecurity risk governance for enterprise and core banking systems, reviewing security requirements, risk assessments, and risk treatment decisions for major and minor initiatives.
• Participated in the development and maintenance of information security risk management policies, processes, and risk models aligned with international standards and Saudi regulatory frameworks, contributing to regulatory compliance and audit readiness.
• Represented the CISO office in change and design governance forums, including IT Change Control and Design Authority Boards, and served as a designated Business Information Security Officer (BISO), supporting early-stage security decision-making and business alignment.