Senior IT GRC Specialist – ISMS & Compliance

PT Media Indonusa (Jakarta); Jakarta Utara; On-site; IDR 279,000,000 - 446,400,000; Full time

Job summary

PT Media Indonusa, trading as Faspay, seeks an IT GRC Specialist (Senior Officer) to lead ISMS operations, compliance, and risk management in Jakarta. You will drive policy lifecycle, coordinate ISO 27001 and PCI DSS activities with QSA, and ensure BI regulations and personal data protections are met.

Ideal candidates have 4–7 years in IT GRC, hands-on ISO 27001 implementation, PCI DSS experience, and the ability to write clear policies and reports in Indonesian and English.

Qualifications

• Bachelor's degree in Information Systems, CS, or related field.
• 4–7 years in IT GRC, risk, audit, or security compliance.
• Experience with Bank Indonesia or payment system operator regulations.
• Hands-on ISO/IEC 27001:2022 implementation and audits.
• PCI DSS v4.x assessments with a QSA background.
• Clear policy/report writing in Indonesian and English.

Responsibilities

• Maintain ISMS: risk register, SoA, risk treatment, audits, reviews.
• Manage policy lifecycle (POL, STD, PRO) and document controls.
• Coordinate ISO 27001 audits and PCI DSS assessments with QSA.
• Maintain regulatory obligations and incident reporting incl. PDPL.
• Lead third-party security risk management and due diligence.
• Oversee BCP/DR testing and RTO/RPO targets.
• Run security awareness programs and report KPIs monthly.

Skills

Policy writing

Risk assessment

Auditing

Regulatory compliance

Education

Bachelor's degree in Information Systems/Computer Science

Tools

ISO/IEC 27001:2022

PCI DSS v4.x

Bank Indonesia regulations

Personal Data Protection Law

Job description

PT Media Indonusa, trading as Faspay, seeks an IT GRC Specialist (Senior Officer) to lead ISMS operations, compliance, and risk management in Jakarta. You will drive policy lifecycle, coordinate ISO 27001 and PCI DSS activities with QSA, and ensure BI regulations and personal data protections are met.

Ideal candidates have 4–7 years in IT GRC, hands-on ISO 27001 implementation, PCI DSS experience, and the ability to write clear policies and reports in Indonesian and English.