Department Manager - Governance, Risk & Compliance (GRC)

The Department Manager - Governance, Risk & Compliance (GRC) is responsible for managing IT risk and security frameworks across Thailand and Malaysia. The role involves interpreting IT risk requirements, conducting risk management, and authoring policies and procedures. The manager will oversee vulnerability and penetration management programs, coordinate with internal and external audits, and drive continuous process improvement using KPIs and KRIs. The position requires a strong focus on security technologies, including Antivirus, EDR, DLP, and VA scanning tools, as well as building security awareness training programs.

Understand and interpret requirements across relevant IT Risk frameworks, map overlapping Technology policies and standards

Conduct Technology Risk Management, Help secure workflows, products, and operations across the company (Thailand & Malaysia) by identifying risk areas, providing recommendations on security compliance and IT governance best practices and authoring respective policies and procedures around security, data governance, and risk

Design, configure, and operate core security technologies, including Antivirus / EDR, Data Loss Prevention (DLP), and Vulnerability Assessment (VA) scanning tools, ensuring effective coverage and risk-based configuration

Oversee and coordinate the Vulnerability and Penetration Management Program, including risk prioritization, remediation tracking, and recommendation of appropriate mitigation solutions

Build & coordinate security awareness & training program for Thailand & Malaysia

5+ years working in IT filed with a focus on information security or IT audit

Knowledge of ISO27001, PCIDSS and IT security control

Exceptional communication, problem solving and cross-group collaboration skills

Good command of written and spoken English

Ability to present ideas in business-friendly and user-friendly language

Ability to prioritize, track and manage a large number of divergent tasks and action items

Ability to influence in a team-oriented, collaborative environment

Coordinate with internal audit, external audit and IT team to provide the information as audit request and update the current status of audit next step to IT management