GRC Lead

This is a fully remote position, open to applicants in Serbia, +3 more countries.

📋 Description

• Take charge of information security risk management, control assurance, and ISO 27001 ISMS governance across a regulated group that includes banking, consumer finance, and technology sectors.

• Develop an independent perspective on security risk and evaluate whether proposed controls effectively address it, collaborating closely with the Group CISO.

• Evaluate the design and operational effectiveness of controls across IAM, cloud, endpoint security, monitoring, vulnerability management, data protection, and secure development.

• Transform risk and control data into clear, actionable reports for governance forums.

• Manage the security risk process comprehensively, encompassing assessment, treatment, acceptance, monitoring, and reporting.

• Oversee the risk register and critically assess risk evaluations and treatment strategies.

• Maintain the security control framework and validate controls using evidence, data, sampling, or technical assessment.

• Propel remediation efforts in collaboration with control owners.

• Sustain the ISO 27001 ISMS, which includes policies and standards, Statement of Applicability, risk records, control evidence, exceptions, and key security registers.

• Monitor control deficiencies, findings, exceptions, and remediation activities.

• Establish KRIs and control metrics and identify when management decisions or escalations are necessary.

⛳️ Requirements

• Substantial hands-on experience in information security risk management, covering inherent and residual risk, treatment, acceptance, control effectiveness, and risk appetite.

• Technical expertise to thoroughly evaluate controls across IAM, cloud, endpoint security, monitoring, vulnerability management, data protection, and secure development.

• Practical experience in reviewing or testing controls.

• Familiarity with ISO 27001.

• Capability to distill complex risk and control information into succinct management reports.

• Comfortable utilizing GRC platforms, structured risk and control registers, and evidence management systems.

• Availability to work core collaboration hours from 12:00 to 6:00 PM Manila time (UTC+8).

• Proficiency in English is required as part of the application process.

🏝️ Benefits

• Fully remote work arrangement with core collaboration hours from 12:00 to 6:00 PM Manila time (UTC+8).

• Provision of company tools and equipment.

• Medical insurance support for you and your family through co-funding or reimbursement, depending on your location and subject to policy limits.

• Access to an internal mental health support specialist.

• 22 vacation days.

• Philippine public holidays.

• 15 sick days.

• Opportunities for learning and sharing expertise through internal expert meetups, external conferences, speaking engagements, and industry publications.

• Company-sponsored trips to Manila for in-person team collaboration.

• High-performing teams can earn a dedicated beach house week in Southeast Asia.