Key Responsibilities
Risk Management & Assessment
- Conduct enterprise-wide cybersecurity risk assessments using frameworks like FAIR and OCTAVE
- Maintain and update cybersecurity risk registers and remediation plans
- Monitor key risk indicators (KRIs) and compliance metrics
- Support third-party/vendor risk assessments and security evaluations
- Evaluate effectiveness of security controls across business processes
Compliance & Audit Management
- Lead internal and external cybersecurity audits and control assessments
- Support regulatory inspections and audit engagements with documentation and evidence
- Collaborate with internal audit and external regulators
- Ensure timely closure of audit findings and remediation actions
- Maintain audit readiness across IT systems and processes
Policy & Governance Management
- Develop and maintain cybersecurity policies, standards, and procedures
- Ensure alignment with frameworks such as ISO 27001, NIST, SOC2, CIS Controls
- Manage policy lifecycle, version control, and governance framework
- Conduct cybersecurity awareness and training programs
- Integrate security policies across business and functional teams
Incident Response & Business Continuity Support
- Support cybersecurity incident investigations and response activities
- Participate in post-incident reviews and root cause analysis
- Contribute to business continuity and disaster recovery planning
- Assist in crisis management coordination when required
Stakeholder Management & Reporting
- Engage with senior leadership, auditors, and cross-functional teams
- Provide compliance and risk reports for executive and board-level review
- Communicate audit findings, risks, and mitigation plans effectively
- Build strong relationships across business units and external stakeholders
Strategic Security Support
- Support cybersecurity due diligence for mergers and acquisitions
- Contribute to cybersecurity maturity improvement initiatives
- Embed security controls into business processes and operations
- Evaluate and improve effectiveness of internal control systems
Continuous Improvement
- Identify gaps in compliance and security frameworks
- Drive process improvements in GRC operations
- Enhance automation and efficiency in risk and compliance reporting
