IT Governance, Risk Management and Compliance Analyst

Company Description

• Job Descriptions

   

  • Establish and maintain information security policies, standard, guidelines, procedures and controls to ensure they meets with company's risk appetite and compliance with applicable regulatory and legal requirements as well as industry standard.
  • Enforce information security policies, standard, guidelines, procedures and controls implementation.
  • Ensure and improve compliance such as PCI DSS, SNI ISO/IEC 27001:2013, and other information security related compliance, law and regulation.
  • Manage and perform end to end risk assessment for various Information systems, services and processes.
  • Act as a Subject Matter Expert (SME) for trending GRC and Information Security topics.
  • Maintain expertise on security trends through training, research and development in order to mitigate potential security exposures.
  • Develop, promote and monitor our corporate wide Information Security awareness and Training Program.
  • Collaborate and work closely with other stakeholders
  • Take ownership on the assigned project
  • Contribute in the process improvement
    
    
• Requirements

   

  • 3-5 years+ of relevant professional experience is preferred.
  • Have a good understanding about threat, vulnerability, impact and risk and their implementation on business process.
  • In-depth knowledge with as many as the following law, regulations, frameworks, and/or industry standards: COBIT, ISO/IEC 27000-series, PCI/DSS, NIST SP 800-53/30, GDPR, PDPA, PP71, UU ITE, etc
  • Demonstrated skills in risk assessment, both quantitatively and qualitatively. Familiarity with maturity models as aids to gap assessment and remediation planning.
  • Ability to act independently and exercise good judgment as well as the ability to work cross functionally and create virtual teams.
  • Ability to prioritize and multitask.
  • Flexibility and adaptability in work approach.
  • Strong written and verbal communication skills especially in English.
  • Strong interpersonal skills;
  • Strong problem-solving and negotiation skills.
  • Calmness and clarity of thought under pressure and ability to maintain confidentiality.
  • Ability to perform effective interaction with a broad range of people and roles. Accept responsibility and personal accountability.
  • Ability to stay updated with current information security trends.
  • Certified in CISSP, CGEIT, CISA, CISM, or other information security certification will be an added value.