IT GRC

Faspay; Jakarta Pusat; On-site; IDR 240,000,000 - 460,000,000; Full time

Job summary

Faspay is seeking an IT Security professional to develop and enforce a comprehensive security program in Jakarta. The role focuses on governance, risk, and compliance, with hands-on work across networks, systems, and applications to safeguard payment infrastructure.

The candidate should hold a degree in a related field and at least two years in security, plus certifications. You will implement policies, manage vulnerabilities, and conduct security awareness for staff.

Qualifications

• Bachelor’s degree in IT or cybersecurity and at least one professional certification.
• Minimum 2 years in IT security with a focus on GRC.
• Payment gateway or financial services experience is a plus.
• Proven in implementing security architecture across systems and networks.
• Experience with audits and compliance (PCI DSS, ISO 27001, NIST) and local rules.
• Strong network, endpoint, and application security knowledge.
• Hands-on with vulnerability management tools.
• Ability to produce security docs and risk assessments.
• Able to train awareness across the organization.

Responsibilities

• Develop and implement IT security architecture covering hardware, OS, networks, databases, and apps.
• Implement IT security policies aligned with standards and regulatory requirements.
• Deploy vulnerability management solutions and lead remediation efforts.
• Continuously monitor IT security and respond to threats in real time.
• Lead security incident response and conduct forensic analysis.
• Provide security awareness training to staff.
• Stay updated on threats and technology trends to ensure protection.
• Maintain ISMS and report suspicious activities.

Skills

GRC knowledge

Security architecture

Vulnerability management

SIEM operations

Security incident handling

Security audits

Regulatory compliance

Risk assessment

Cross-functional collaboration

Clear communication

Education

Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, or related field

Professional certifications (CISSP, CISA, CISM, CEH, ISO 27001 Lead Implementer)

Tools

Nessus

Qualys

Rapid7

OpenVAS

Job description

Job Requirements

• Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, or a related field.
• Relevant professional certifications (at least one required), such as:
• CISSP, CISA, CISM, CEH, ISO 27001 Lead Implementer, or equivalent.
• Minimum 2 years of experience in IT Security, particularly in Governance, Risk, and Compliance (GRC).
• Prior experience in Payment Gateway, or Financial Services industry is a strong plus.
• Proven experience in implementing and managing IT security architecture across hardware, operating systems, networks, databases, and applications.
• Solid experience in security audits and ensuring compliance with industry standards (e.g., PCI DSS, ISO 27001, NIST) and local regulations (e.g., Bank Indonesia, OJK).
• Strong understanding of network, endpoint, and application security principles.
• Hands-on experience with Vulnerability Management tools (e.g., Nessus, Qualys, Rapid7, OpenVAS).
• Proficient in developing and implementing IT security policies and procedures.
• Experience in security incident handling and forensic investigation.
• Familiar with SIEM tools (Security Information and Event Management) and real-time threat monitoring.
• Capable of conducting risk assessments and preparing comprehensive security documentation.
• Deep knowledge of security frameworks such as ISO 27001, NIST CSF, COBIT, or equivalent.
• Ability to conduct security awareness training across different levels of the organization.
• Strong communication skills, especially in presenting security findings and recommendations to non-technical stakeholders.
• Collaborative mindset with the ability to work cross-functionally with IT, compliance, legal, and business teams.
• Proactive problem-solver with the ability to respond quickly and effectively in security incidents.

Job Requirements

• Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, or a related field.
• Relevant professional certifications (at least one required), such as:
• CISSP, CISA, CISM, CEH, ISO 27001 Lead Implementer, or equivalent.
• Minimum 2 years of experience in IT Security, particularly in Governance, Risk, and Compliance (GRC).
• Prior experience in Payment Gateway, or Financial Services industry is a strong plus.
• Proven experience in implementing and managing IT security architecture across hardware, operating systems, networks, databases, and applications.
• Solid experience in security audits and ensuring compliance with industry standards (e.g., PCI DSS, ISO 27001, NIST) and local regulations (e.g., Bank Indonesia, OJK).
• Strong understanding of network, endpoint, and application security principles.
• Hands-on experience with Vulnerability Management tools (e.g., Nessus, Qualys, Rapid7, OpenVAS).
• Proficient in developing and implementing IT security policies and procedures.
• Experience in security incident handling and forensic investigation.
• Familiar with SIEM tools (Security Information and Event Management) and real-time threat monitoring.
• Capable of conducting risk assessments and preparing comprehensive security documentation.
• Deep knowledge of security frameworks such as ISO 27001, NIST CSF, COBIT, or equivalent.
• Ability to conduct security awareness training across different levels of the organization.
• Strong communication skills, especially in presenting security findings and recommendations to non-technical stakeholders.
• Collaborative mindset with the ability to work cross-functionally with IT, compliance, legal, and business teams.
• Proactive problem-solver with the ability to respond quickly and effectively in security incidents.

Job Description

• Develop and implement comprehensive IT security architecture covering the security of hardware, operating systems, networks, databases, and applications.
• Implement IT Security Policies in accordance with industry standards and regulatory requirements.
• Deploy Vulnerability Management Solutions and lead necessary remediation efforts proactively.
• Continuously monitor and assess IT security to detect and respond to potential threats.
• Conduct security awareness training for staff to enhance understanding and vigilance regarding information security.
• Lead security incident response efforts in collaboration with relevant stakeholders, and perform forensic analysis to identify root causes and impacts.
• Stay up to date with the latest security trends and technological developments to ensure effective protection against emerging threats.
• Responsible for maintaining the information security system by adhering to security policies, protecting company data, and reporting suspicious activities that may pose a threat to information security.