GRC Specialist (ISO27001)

Maintain and continuously improve the Information Security Management System (ISMS) documentation, including policies, procedures, Statement of Applicability, and risk treatment plans aligned to ISO 27001:2022. Conduct internal audits across IT infrastructure, HR onboarding, and vendor management to identify gaps, drive corrective actions to closure, and produce findings with specific evidence. Manage the ISO 27001 certification lifecycle by preparing for surveillance audits, coordinating with certification bodies, and tracking non-conformity report resolution. Facilitate information security risk assessments using ISO 27005 methodologies to identify threats, assess likelihood and impact, and recommend treatment options. Produce ISMS performance metrics and management review inputs while ensuring all policies are reviewed at defined intervals and communicated to stakeholders. Coordinate with other compliance frameworks like PDPA and PCI-DSS to identify synergies and reduce duplicate effort across programmes.