GRC Officer

Role Overview

The GRC Officer will play a critical role in strengthening the organization’s governance, risk, and compliance posture across the business. This role ensures alignment with global security and data protection requirements, enabling the company to operate securely, meet regulatory obligations, and maintain trust with customers and stakeholders.

Responsibilities

• Develop, implement, and maintain governance, risk, and compliance (GRC) frameworks, policies, and procedures.
• Conduct regular risk assessments to identify control gaps, evaluate threats, and recommend mitigation actions.
• Monitor and ensure compliance with relevant standards and regulations, including ISO 27001, PCI-DSS, NIST, and data protection requirements.
• Support IT General Controls (ITGC) design, documentation, testing, and remediation activities.
• Coordinate internal and external audits, including evidence collection, remediation tracking, and issue resolution.
• Partner with cross-functional teams to embed security, privacy, and compliance controls into business processes and technology initiatives.
• Track regulatory changes and industry best practices to update compliance programs and risk management activities.
• Prepare and present GRC reports, metrics, and status updates to leadership and key stakeholders.

Qualifications

Required

• Bachelor's degree in Information Security, Computer Science, or a related field
• 5+ years of experience in GRC, compliance, information security, or risk management
• Hands-on experience with ISO 27001, PCI-DSS, NIST, or similar security standards
• Experience conducting risk assessments and supporting compliance audits
• Working knowledge of IT General Controls and data protection requirements

Preferred

• Professional certification such as CISA, CISSP, CRISC, or ISO 27001 Lead Implementer/Lead Auditor
• Experience in a global technology or high-growth digital organization
• Exposure to privacy regulations and cross-border data protection requirements
• Experience building or maturing enterprise-wide GRC programs
• Familiarity with cloud security and third-party risk management