GRC and Supplier Assurance

This role focuses on balancing exceptional delivery with business needs, serving as a first layer of management for people or projects. The professional will interpret IT risk and cybersecurity requirements, develop information security policies, and conduct technology risk assessments. They will manage the risk acceptance process, coordinate with audit stakeholders, and define security KPIs and KRIs to measure control effectiveness and governance maturity.

Understand and interpret requirements across relevant IT Risk, Cybersecurity, Regulatory and map requirements against the organization's technology and security policies, standards and control

Develop, establish, maintain, and continuously improve the organization's Information Security Policies, Standards and Guidelines ensuring alignment with business requirements, regulatory obligations, and industry best practices

Conduct Technology Risk Assessments across applications, infrastructure, products, projects, and operations. Identify risks and control gaps, recommend appropriate remediation or mitigating controls, and track risks through closure or formal risk acceptance

Manage the Risk Acceptance process, ensuring exceptions have appropriate business justification, compensating controls, accountable risk owners, defined expiry dates, and periodic review

Coordinate with internal audit, external audit and other stakeholders to support audit and assessment, provide the information as audit request and regular report status to IT and Security management

Bachelor's or Master's degree in Computer Science, Information Security, or a related field

5+ years working in IT filed with a focus on information security or IT audit

Knowledge of ISO27001, PCIDSS and IT security control

Exceptional communication, problem solving and cross-group collaboration skills

Good command of written and spoken English

Ability to present ideas in business-friendly and user-friendly language

Extensive experience in implementing and managing enterprise-level Identity and Access Management solutions, ensuring compliance with regulatory requirements and leading cross-functional teams to maintain a secure IAM environment