IT GRC

Job Requirements

• Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, or a related field.

• Relevant professional certifications (at least one required), such as:

• CISSP, CISA, CISM, CEH, ISO 27001 Lead Implementer, or equivalent.

• Minimum 2 years of experience in Governance, Risk, and Compliance (GRC).

• Prior experience in Payment Gateway, or Financial Services industry is a strong plus.

• Solid experience in security audits and ensuring compliance with industry standards (e.g., PCI DSS, ISO 27001, NIST) and local regulations (e.g., Bank Indonesia, OJK).

• Proficient in developing and implementing IT security policies and procedures.

• Capable of conducting risk assessments and preparing comprehensive security documentation.

• Deep knowledge of security frameworks such as ISO 27001, NIST CSF, COBIT, or equivalent.

• Ability to conduct security awareness training across different levels of the organization.

• Strong communication skills, especially in presenting security findings and recommendations to non-technical stakeholders.

• Collaborative mindset with the ability to work cross-functionally with IT, compliance, legal, and business teams.

• Proactive problem-solver with the ability to respond quickly and effectively in security incidents.
  

Job Description:

• Develop, review, and update IT policies, procedures, and standards to ensure alignment with business objectives and regulatory requirements. 

• Ensure the company complies with relevant regulations, including but not limited to GDPR, PCI-DSS, ISO 27001, and SOX.

• Coordinate with the Legal & Compliance teams to ensure regulatory alignment.

• Manage IT audits and properly follow up on audit findings.

• Conduct training and awareness programs on compliance requirements and best practices for employees.

• Develop and maintain IT-related disaster recovery and business continuity plans.

• Maintain an up-to-date list of IT and cybersecurity risks, along with corresponding mitigation plans.

• Responsible for maintaining the information security system by adhering to security policies, protecting company data, and reporting any suspicious activities that may threaten information security.