Senior Cybersecurity and GRC Analyst

This is a fully remote position, open to applicants in Malaysia.

📋 Description

• Develop and manage cybersecurity initiatives throughout the organization while ensuring that security policies and procedures align with industry best practices.

• Monitor and assess security alerts across various environments, utilizing logging and monitoring tools, and endpoints; enhance monitoring capabilities, including centralized log management.

• Investigate incidents related to phishing, unusual login attempts, malware, and emerging threats.

• Conduct vulnerability assessments, validate and prioritize findings along with bug bounty submissions, and collaborate with developers on remediation efforts.

• Supervise and evaluate user access, particularly for privileged accounts, ensuring the prompt revocation of access for departing employees.

• Identify and evaluate cybersecurity risks, following up with responsible parties until issues are resolved.

• Suggest, adjust, and oversee security controls.

• Examine, document, and coordinate responses to security incidents, participating in post-incident evaluations.

• Facilitate security awareness training and phishing simulations for staff.

• Maintain incident records and risk reports, presenting cybersecurity updates during the annual management meeting.

• Complete security questionnaires and compliance requests from suppliers and customers.

• Organize penetration tests and communicate with external testers.

• Provide technical documentation for SOC 2, ISO/IEC 27001, and ISO/IEC 27701 audits, ensuring security documentation is ready for audits.

• Lead the risk management meetings and ensure the risk register is kept current.

⛳️ Requirements

• Bachelor's degree in Computer Science, IT, Cybersecurity, or a related area, or equivalent professional experience.

• A minimum of one cybersecurity certification is essential, such as CISSP, CompTIA CySA+, GIAC (GCIH or GSEC), or a cloud security certification.

• Over 5 years of practical experience in cybersecurity, including security operations, vulnerability management, and incident response; experience in larger or regulated organizations is preferred.

• In-depth knowledge of cloud, network, endpoint, identity, and application security.

• Practical experience with AWS security services, log monitoring, endpoint management and protection, and vulnerability scanning tools; experience with SIEM and EDR is highly valued.

• Familiarity with SOC 2, ISO/IEC 27001, and ISO/IEC 27701, including audit evidence and security questionnaires.

• Self-sufficient, meticulous, and thorough, with the determination to follow through with colleagues at all levels until tasks are completed.

• Capable of articulating risk clearly to non-technical personnel and presenting to management.

🏝️ Benefits

• Opportunity to advance into a security leadership position.

• An engaging and dynamic team united in pursuit of a shared mission.

• Competitive salary package.

• Coverage for annual maintenance and membership fees for relevant cybersecurity certifications.