GRC Specialist (ISO27001)

CP Axtra (Makro Pro) is hiring a GRC Specialist focused on ISO 27001 to serve as the company's subject matter expert on the Information Security Management System. The role handles practical implementation and continual improvement of the ISMS, including maintaining documentation such as policies, procedures, the Statement of Applicability, and risk treatment plans aligned to ISO 27001:2022.

Day-to-day duties include planning and conducting the annual internal audit programme, managing the ISO 27001 certification lifecycle with the certification body, running information security risk assessments using ISO 27005-style methodology, driving corrective and preventive actions to closure, maintaining the risk register, producing ISMS performance metrics, and coordinating with other compliance frameworks such as PDPA and PCI-DSS. The role requires 5+ years in information security, at least 3 years focused on ISO 27001, and an ISO 27001 Lead Auditor or Lead Implementer certification.

Maintain and continuously improve ISMS documentation including policies, procedures, SOA, and risk treatment plans aligned to ISO 27001:2022

Plan and conduct the annual internal audit programme and produce findings with specific evidence

Manage the ISO 27001 certification lifecycle including surveillance audits, recertification, and NCR resolution

Conduct and facilitate information security risk assessments and maintain the risk register and treatment plans

Drive corrective and preventive actions (CAPA) to closure and produce ISMS performance metrics and management review inputs

5+ years in information security with at least 3 years focused on ISO 27001 implementation and maintenance

ISO 27001 Lead Auditor or Lead Implementer certification (non-negotiable)

Hands-on experience conducting internal audits including planning programmes and writing findings

Practical experience with information security risk assessment methodologies (ISO 27005 or equivalent)

Fluent in Thai for audits and stakeholder communication; reading/writing English for ISO standards and documentation