GRC & PCI DSS Compliance Engineer

SNSoft Sdn Bhd; Kuala Lumpur; On-site; MYR 70,000 - 120,000; Full time

Benefits offered by this job

Competitive salary

Project incentive

Sports activities

Training & certification

Medical & dental

Job summary

SNSoft Sdn Bhd is seeking a Security Compliance Specialist/Compliance Engineer (GRC) to lead day‑to‑day PCI DSS compliance activities, evidence collection, remediation tracking, and coordination with external assessors.

You will maintain security policies and documentation, manage risk registers and third‑party inventories, and work with engineering, operations, and vendors to drive cross‑region compliance.

Qualifications

• 2+ years in security compliance / information security management systems
• Experience implementing or maintaining PCI DSS / ISO 27001 / SOC 2
• Familiar with evidence and documentation management; detail‑oriented and organized
• Good communication and cross‑team coordination
• Basic understanding of cloud environments (Alibaba Cloud / AWS / Tencent)

Responsibilities

• Handle PCI DSS annual maintenance: collect evidence, organize documentation, track remediation to closure
• Coordinate with QSA / ASV / annual pentest and follow up with external assessors
• Maintain security policies, process docs, and compliance records (risk register, vendor inventory)
• Follow up on third‑party / vendor compliance materials
• Assist in preparing compliance materials for multi‑region expansion
• Run company‑wide security awareness training and phishing drills
• Coordinate with engineering/ops/business on remediation activities

Skills

Security compliance

Documentation management

Communication

Cloud basics

Education

Bachelor’s or Master’s in CS/Engineering/Math/Stats

Tools

PCI DSS

ISO 27001

SOC 2

Job description

SNSoft Sdn Bhd is seeking a Security Compliance Specialist/Compliance Engineer (GRC) to lead day‑to‑day PCI DSS compliance activities, evidence collection, remediation tracking, and coordination with external assessors.

You will maintain security policies and documentation, manage risk registers and third‑party inventories, and work with engineering, operations, and vendors to drive cross‑region compliance.