IT GRC Consultant (Project-Based)

Crowe Indonesia; Jakarta Pusat; On-site; IDR 360,000,000 - 600,000,000; Full time

Job summary

Crowe Indonesia is seeking a seasoned IT GRC and risk professional to lead assessments, develop remediation roadmaps, and support audits across client environments.

You will translate regulatory requirements into practical controls, design governance frameworks, and collaborate with stakeholders in English and Bahasa Indonesia to strengthen information security programs in ISO 27001, NIST, or COBIT contexts.

Qualifications

• Professional experience in IT GRC, IT audit, information security, or IT risk consulting.
• Hands-on experience delivering ISO 27001, NIST, or COBIT implementation or assessment projects end to end.
• Strong understanding of risk management methodologies (ISO 31000, ISO 27005, or similar).
• Ability to translate regulatory requirements into practical, actionable controls and documentation.
• Strong communication and documentation skills in English and Bahasa Indonesia.
• Self-driven, able to manage deadlines and deliverables without daily supervision.
• Relevant certifications such as CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Lead Auditor, or CISSP are an advantage.

Responsibilities

• Conduct gap assessments against relevant standards and regulations, and develop compliance matrices and remediation priorities.
• Perform IT risk assessments, including asset, threat, and vulnerability identification, risk analysis, and development of risk registers and risk treatment plans.
• Develop and review policies, standards, procedures, and ISMS or IT governance documentation.
• Design control frameworks and perform control mapping across multiple standards.
• Conduct third-party/vendor risk assessments.
• Support preparation for internal, external, or certification audits, including evidence collection, stakeholder preparation, and follow-up on findings.
• Prepare reports, executive summaries, and remediation roadmaps for management.
• Monitor remediation progress until findings are closed.

Skills

IT GRC

IT audit

Information security

Risk consulting

Regulatory translation

Communication in English

Bahasa Indonesia

Self-driven

Tools

ISO 27001

NIST

COBIT

Job description

• Conduct gap assessments against relevant standards and regulations, and develop compliance matrices and remediation priorities.
• Perform IT risk assessments, including asset, threat, and vulnerability identification, risk analysis, and development of risk registers and risk treatment plans.
• Develop and review policies, standards, procedures, and ISMS or IT governance documentation.
• Design control frameworks and perform control mapping across multiple standards.
• Conduct third-party/vendor risk assessments.
• Support preparation for internal, external, or certification audits, including evidence collection, stakeholder preparation, and follow-up on findings.
• Prepare reports, executive summaries, and remediation roadmaps for management..
• Monitor remediation progress until findings are closed.

Requirements

• Professional experience in IT GRC, IT audit, information security, or IT risk consulting.
• Hands-on professional experience delivering ISO 27001, NIST, or COBIT implementation or assessment projects end to end.
• Strong understanding of risk management methodologies (ISO 31000, ISO 27005, or similar).
• Ability to translate regulatory requirements into practical, actionable controls and documentation.
• Strong communication and documentation skills in English and Bahasa Indonesia.
• Self-driven, able to manage deadlines and deliverables without daily supervision.
• Relevant certifications such as CISA, CISM, CRISC, CGEIT, ISO 27001 Lead Implementer/Lead Auditor, or CISSP are an advantage.