What you'll actually do
- Develop and maintain information security policies and procedures
- Conduct risk assessments and manage the risk register
- Lead internal and external security audits
- Ensure compliance with PDPA, ISO 27001, PCI DSS, etc.
- Manage third-party vendor risk assessments
- Report risk posture to senior management and board
Skills you need
Risk assessment methodologiesRegulatory and compliance frameworksPolicy and procedure writingAudit planning and executionVendor risk managementBusiness communication and report writing
Tools & platforms
GRC platforms (ServiceNow GRC, Archer)Microsoft Office / SharePointJIRA (for tracking compliance tasks)Risk management tools (Riskonnect)
Certifications to Target
1CISA (Certified Information Systems Auditor)
2CRISC (Certified in Risk and Information Systems Control)
3ISO 27001 Lead Auditor / Lead Implementer
4CISM (Certified Information Security Manager)
Who Is a Good Fit?
- → Auditors (IT or internal)
- → Compliance officers
- → Legal / Risk management professionals
- → Business analysts pivoting to cybersecurity
Career Growth Path
1
GRC Analyst → Senior GRC Analyst2
→ GRC Manager / Compliance Manager3
→ Head of Risk / CISO4
→ Independent GRC Consultant