IT GRC

PT Media Indonusa (Jakarta); Jakarta Utara; On-site; IDR 279,000,000 - 446,400,000; Full time

Job summary

PT Media Indonusa, trading as Faspay, seeks an IT GRC Specialist (Senior Officer) to lead ISMS operations, compliance, and risk management in Jakarta. You will drive policy lifecycle, coordinate ISO 27001 and PCI DSS activities with QSA, and ensure BI regulations and personal data protections are met.

Ideal candidates have 4–7 years in IT GRC, hands-on ISO 27001 implementation, PCI DSS experience, and the ability to write clear policies and reports in Indonesian and English.

Qualifications

• Bachelor's degree in Information Systems, CS, or related field.
• 4–7 years in IT GRC, risk, audit, or security compliance.
• Experience with Bank Indonesia or payment system operator regulations.
• Hands-on ISO/IEC 27001:2022 implementation and audits.
• PCI DSS v4.x assessments with a QSA background.
• Clear policy/report writing in Indonesian and English.

Responsibilities

• Maintain ISMS: risk register, SoA, risk treatment, audits, reviews.
• Manage policy lifecycle (POL, STD, PRO) and document controls.
• Coordinate ISO 27001 audits and PCI DSS assessments with QSA.
• Maintain regulatory obligations and incident reporting incl. PDPL.
• Lead third-party security risk management and due diligence.
• Oversee BCP/DR testing and RTO/RPO targets.
• Run security awareness programs and report KPIs monthly.

Skills

Policy writing

Risk assessment

Auditing

Regulatory compliance

Education

Bachelor's degree in Information Systems/Computer Science

Tools

ISO/IEC 27001:2022

PCI DSS v4.x

Bank Indonesia regulations

Personal Data Protection Law

Job description

We are seeking an IT GRC Specialist (Senior Officer Level) to run the company's Information Security Management System (ISMS) and information technology compliance on a daily basis, covering ISO/IEC 27001:2022, PCI DSS 4.0.1, Bank Indonesia regulations for payment system operators (including PBI 2/2024 on Information System Security and Cyber Resilience), and Law No. 27 of 2022 on Personal Data Protection. This position reports to the Head of IT Security.

Key responsibilities

Maintain the Company's ISMS: risk register, Statement of Applicability (SoA), risk treatment plans, internal audits, and management reviews.

Execute the policy framework lifecycle (POL, STD, PRO) — review, approval, and version control — and develop planned policy documents, starting with Logging & Monitoring, BCP/DR, and Personnel Screening.

Coordinate ISO 27001 audits and PCI DSS assessments with Qualified Security Assessors (QSA): evidence collection, finding tracking, and compensating control documentation.

Maintain regulatory obligations register and reporting to Bank Indonesia, including incident notification processes (initial notification 1 hour, full report 3 days), and — together with the Legal function — personal data breach notifications in accordance with the Personal Data Protection Law.

Execute third-party security risk management in accordance with procedure PRO-06: vendor due diligence, contract clauses, and annual reviews.

Coordinate Business Continuity Plan (BCP) and Disaster Recovery (DR) testing, and monitor achievement of recovery time objectives (RTO) and recovery point objectives (RPO).

Execute security awareness program for employees and monitor completion rates.

Report compliance status and key risk indicators to the Head of IT Security monthly.

About you

Bachelor's degree (S1) in Information Systems, Computer Science, or related field.

4–7 years of experience in IT GRC, IT risk, IT audit, or security compliance, with at least 2 years at a company regulated by Bank Indonesia or the Financial Services Authority (payment system operators, banks, electronic money, or fintech).

Hands‑on experience implementing ISO/IEC 27001:2022, including risk assessment, Statement of Applicability development, and internal audits.

Experience supporting PCI DSS v4.x assessments with a Qualified Security Assessor (QSA).

Understanding of Bank Indonesia regulations for payment system operators and Law No. 27 of 2022 on Personal Data Protection.

Ability to write policies and reports clearly and in a structured manner, in both Indonesian and English.

Integrity and discretion. This role has access to sensitive incident details and audit results.

Assertive yet professional. Able to persistently follow up on deadlines with senior control owners without damaging working relationships.

Structured and precise writing. Policies and reports produced are clear, unambiguous, and easily auditable.

About us

Faspay, operated by PT Media Indonusa, is a payment gateway service provider serving thousands of merchants and connected with major banks in Indonesia. Our business activities are entirely based on the trust that funds and data entrusted to us are safeguarded and governed adequately.

Unlock job insights

Your application will include the following questions:

• What's your expected monthly basic salary?