Many leaders who set out to hire a SOC analyst in Saudi Arabia begin with the assumption that NCA ECC and the SAMA Cyber Security Framework (SAMA CSF) require a permanent employee for every security function. In practice, both frameworks focus on whether capabilities exist, are governed and can be evidenced. How the capability is staffed is largely a decision for the institution, and it should be made deliberately.
Four factors usually decide the answer: incident volume, regulatory scrutiny, budget predictability and knowledge retention. The four scenarios below show how those factors play out.
The three staffing models
Permanent hire gives you an employee who accumulates institutional knowledge and is fully dedicated to your environment. It carries recruitment time, fixed cost and key-person risk.
Contract specialist gives you a named expert for a defined scope or period, without a permanent headcount commitment.
Managed service gives you a capability, such as monitoring, delivered by a provider against an agreed scope rather than by individuals you manage.
These are not mutually exclusive. Many institutions combine them, and the right mix changes as the organization matures.
Scenario 1: 24/7 monitoring for a payment firm
A payment firm handles continuous transaction flow, is under close supervisory attention and must show timely detection and response. SAMA CSF and, where card data is involved, PCI DSS both expect monitoring and incident handling to be effective and evidenced.
Round-the-clock coverage is the difficulty. Staffing a genuine 24/7 rota internally means several analysts per shift position, plus cover for leave, illness and attrition. A single permanent analyst cannot provide this, and a small team tends to burn out.
Signs a managed detection service is the better fit:
- You have fewer analysts than a continuous rota requires.
- Alerts go unreviewed outside office hours.
- Analyst turnover is repeatedly interrupting coverage.
Signs permanent hires are worth adding:
- Incident volume is high enough to justify in-house triage and tuning.
- You need people who understand your payment flows and fraud patterns in depth.
A sound outcome is often hybrid: managed monitoring for continuous coverage, with a small permanent team owning escalation, tuning and relationships with the business.
Scenario 2: part-time GRC for a captive insurer
A captive insurer has a limited footprint, a small team and a modest volume of change. It still falls under insurance-sector expectations and must align with NCA ECC and, where relevant, PDPL. The workload is real but uneven: policy updates, risk registers, periodic assessments and audit preparation.
A full-time GRC officer may be under-used for much of the year, while the work still requires someone who understands Saudi regulatory requirements. Here a part-time or on-call model usually delivers better value and more predictable cost.
Consider this model when:
- The GRC workload peaks around audits and annual reviews.
- The institution cannot justify a full-time salary for the volume of work.
- Leadership needs a clear view of risk but not a full-time executive.
Two of our services address this situation. Our GRC Advisory provides governance, risk and compliance frameworks tailored to Saudi regulatory requirements including SAMA CSF and NCA ECC. Where strategic direction is the gap rather than day-to-day compliance, our vCISO Services provide experienced security leadership without a full-time hire.
The trade-off is knowledge retention. Part-time arrangements work best when documentation is kept current and owned by the institution, so that nothing depends on one external person's memory.
Scenario 3: project-based penetration testing for a fintech
A fintech releases features frequently and needs independent testing before major launches, after significant architecture changes and in line with annual assurance requirements. The demand is spiky: intense for a few weeks, then quiet.
A permanent penetration tester is rarely the efficient answer for this pattern. Testing also benefits from independence; an internal tester who helped build the system may miss what an outsider will see. A contract specialist, engaged for a defined scope and period, fits better.
A permanent security engineer becomes more attractive when:
- Releases are continuous and security review is needed inside the development cycle.
- The product handles sensitive data under PDPL and needs ongoing secure design input.
Even then, many fintechs keep external testing for independent assurance and use the permanent engineer to fix findings and prevent repeats.
Scenario 4: interim cover during recruitment
Senior security roles in the Kingdom can take time to fill. When an analyst, GRC officer or security manager leaves, controls still need to operate, tickets still need answers and audit dates do not move.
Interim cover keeps the function running while the permanent search proceeds. Contract specialists are the usual route, as they can step into a defined role and hand over cleanly to the successful candidate.
Good interim cover has these features:
- A clear scope that matches the vacant role.
- Documented handover notes and open items.
- A defined end date tied to the permanent hire's start.
The risk to avoid is the open-ended stopgap, where temporary cover becomes the default model without a decision having been made.
How to choose
Work through the following questions in order:
- How many hours of coverage does the function actually require, and can your headcount provide them?
- Is the work continuous, periodic or project-based?
- How much institutional knowledge does the role depend on, and how will it be retained?
- Does the regulator or your auditor expect independence for this activity?
- Can your budget absorb a fixed salary, or does variable cost suit you better?
Continuous, knowledge-heavy work leans toward permanent hires. Periodic or specialist work leans toward contract expertise. Capabilities that need constant coverage but not deep local context lean toward managed services. Whichever you choose, document the decision and the evidence of oversight, because regulators and auditors will ask how responsibility is retained when work is outsourced.
Next step
If you are weighing these options, our Cybersecurity talent — recruitment and outsourcing service is built for the decision. We find, assess and place cybersecurity people for you — permanent hires, or specialists on our payroll working on your team. Its scope maps to SAMA CSF, NCA ECC, PDPL, ISO 27001, PCI DSS and SAMA CRFR. Speak to us about which model fits your institution before you open a requisition.
