GRC Analyst: ISO 27001 & Compliance Programs

Brooks Automation; George Town; On-site; MYR 90,000 - 180,000; Full time

Job summary

Brooks Automation in Malaysia seeks a hands-on GRC Analyst to advance our ISMS, risk governance, and regulatory readiness. You will work with the CISO and stakeholders across IT, Engineering, Legal, HR, and Quality to translate frameworks into actionable security programs.

This role goes beyond checkbox compliance, focusing on measurable improvements, audits, metrics, and customer/security questionnaire responses, with on-site work in Penang or Johor Bahru.

Qualifications

• 5-7 years of experience in Governance, Risk & Compliance, Information Security, Internal Audit, IT Audit, Risk Management, or related discipline.
• Working knowledge of information security principles and controls.
• Experience supporting compliance initiatives or audits.
• Strong written communication and documentation skills.
• Ability to communicate effectively with both technical and non-technical stakeholders.
• Strong organizational skills and attention to detail.
• Ability to manage multiple projects and deadlines simultaneously.

Responsibilities

• Support and maintain Brooks' ISO 27001 Information Security Management System (ISMS).
• Coordinate internal audits, external audits, surveillance audits, and certification activities.
• Assist with policy development, policy reviews, standards, procedures, and governance documentation.
• Maintain control ownership, evidence repositories, and audit readiness documentation.
• Coordinate remediation tracking and corrective action plans.
• Facilitate cybersecurity risk assessments and business impact discussions.
• Maintain risk registers and assist control owners with mitigation planning.
• Track risk treatment plans and exceptions.
• Support management reporting, metrics, and risk dashboards.
• Respond to customer security questionnaires and due diligence requests.
• Support supplier and third-party security reviews.
• Assist with regulatory and customer requirements including ISO 27001, NIST CSF, NIST 800-171, GDPR, CRA, and semiconductor customer security requirements.
• Partner with Legal and business stakeholders on security-related contractual requirements.
• Coordinate annual security awareness training campaigns.
• Manage phishing simulation programs.
• Track participation and compliance metrics.
• Develop security awareness communications and educational materials.
• Support incident management governance activities.
• Ensure incidents are properly documented and tracked.
• Assist with lessons learned and corrective action reviews.
• Help maintain security program documentation, standards, procedures, and evidence libraries.
• Develop metrics, dashboards, and executive reporting.
• Assist with annual policy reviews and governance initiatives.
• Drive continuous improvement activities across the security program.

Skills

Governance & Risk

Compliance

Communication

Project management

Job description

Brooks Automation in Malaysia seeks a hands-on GRC Analyst to advance our ISMS, risk governance, and regulatory readiness. You will work with the CISO and stakeholders across IT, Engineering, Legal, HR, and Quality to translate frameworks into actionable security programs.

This role goes beyond checkbox compliance, focusing on measurable improvements, audits, metrics, and customer/security questionnaire responses, with on-site work in Penang or Johor Bahru.