Asst Manager, Cyber Org Alignment and Compliance

The Information Security Cyber Organization Alignment and Compliance position focuses on aligning our information security practices with the company's overall risk management strategy, compliance requirements, and governance frameworks. The role emphasizes driving Information Security Governance, Risk, and Compliance (GRC) initiatives to strengthen the company's security posture while ensuring alignment with regulatory and business objectives through effective processes, such as risk tracking, compliance monitoring, and evaluating exceptions. The role ensures the right level of governance and compliance are in place and drives continuous improvement in risk management processes.

Responsibilities

• Ensure compliance with policies, regulatory requirements, and industry standards.
• Identify, assess, and manage information security risks with the business.
• Ensure adherence to internal and external compliance requirements.
• Perform risk trend analysis and reporting.
• Develop and maintain a comprehensive process for managing policy exceptions, including documentation, expiration dates, and approval workflows.
• Ensure all policy exceptions are properly documented, reviewed, and approved in accordance with organizational standards.
• Drive risk assessments for proposed policy exceptions to evaluate their potential impact on compliance and security.
• Work with stakeholders to communicate the policy exception process, develop compensating controls for policy exceptions, and ensure timely closure.
• Regularly review and monitor granted exceptions to ensure compliance with the terms and conditions.
• Conduct periodic reviews of approved exceptions and identify gaps for improvements.
• Develop and maintain a comprehensive service catalog that accurately reflects the services offered by ISG.
• Regularly review and update the service catalog to ensure it aligns with business needs and technological advancements.
• Monitor the performance of ISG services to ensure they meet established service level agreements (SLAs) and key performance indicators (KPIs).

Requirements

• Minimum 6–8 years of total professional experience, including 4–6 years of dedicated Information Security GRC experience.
• Familiarity with information security technologies, risk, threat and vulnerability assessments, and security measures.
• Experience with governance, risk management, and compliance frameworks (e.g., ISO 27001, NIST, GDPR, PDPL).
• Hold professional certifications such as CISA, CISM, CISSP, CRISC.
• Strong communication and interpersonal skills.
• Ability to manage multiple projects and priorities.
• Proficiency in security tools and technologies.
• Foster a culture of security awareness and compliance within the organization.
• Continuously improve the information security posture of the organization.
• Ensure that information security risks are effectively managed and mitigated.