Specialist - IT Security GRC

Senior Analyst - IT Security GRC

He / She will
1.Implement security controls, risk assessment framework that align to requirements, ensuring documented and sustainable compliance.
2.Evaluates risks and develops security standards, procedures, and controls to manage risks. 
3.Implements processes such as GRC (governance, risk and compliance), to automate and continuously monitor information security controls, exceptions, risks. Develops reporting metrics, dashboards, and evidence artifacts.
4.Defines and documents business process responsibilities and ownership of the controls.  Schedules regular assessments and testing of effectiveness and efficiency of controls and creates GRC reports.
5.Review and update security controls and provides support to all stakeholders covering internal assessments, regulations, protecting Personally Identifying Information (PII) data.
6.Performs and investigates internal and external information security risk and exceptions assessments. Assess incidents, vulnerability management, scans, patching status, secure baselines, penetration test result, phishing, and social engineering tests and attacks.
7.Documents and reports control failures and gaps to stakeholders. Provides remediation guidance and prepares management reports to track remediation activities.
8.Trains, guides, and acts as a resource on security risk assessment functions to other departments.

Requirements

• Specific Education
  • Any Graduate or Master degree
• Work Experience
  • 5 to 10 years
• Special Skills
  • Profound knowledge in Governance, Risk assessment, Information systems auditing, monitoring, controlling and assessment process.
  • Ability to maintain effective working relationships with service provider, project teams, and internal IT and business departments with strong communication skills and a strong ability to deal constructively with conflicting targets beyond own or team reporting line. 
  • English business fluent, intercultural skills to lead/ interact foreign countries team members or vendor counterparts
  • knowledge in IT service delivery. Knowledge of all ITIL Processes. CISA, NIST certification would be preferred.