Senior GRC Consultant - Cyber Risk & Compliance Advisory

EC-Council Global Services; Kuala Lumpur; On-site; MYR 150,000 - 210,000; Full time

Job summary

EC-Council is seeking a Senior Consultant – Information Security GRC to join our Kuala Lumpur team. You will lead client-facing engagements, assess governance, risk, and compliance, and deliver high-quality reports across industries.

This role requires strong communication, stakeholder management, and hands-on risk assessment experience. The candidate should have 4–7 years in GRC or security consulting, professional certifications, and the ability to mentor junior staff while delivering multiple

Qualifications

• Bachelor’s Degree in Cybersecurity, Information Technology, Information Systems, Computer Science, Risk Management, or a related discipline.
• Approximately 4–7 years of relevant experience in Information Security GRC, Cybersecurity Consulting, IT Risk, Technology Risk, Cybersecurity Audit, IT Audit, Regulatory Compliance, or Information Security Management Systems.
• Good working knowledge of recognised standards and frameworks such as ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, ISO 22301, ISO/IEC 42001, NIST Cybersecurity Framework, CIS Controls, COBIT, and SOC 2 Trust Services Criteria.
• Possession of one or more relevant professional certifications such as ISO/IEC 27001 Lead Auditor / Lead Implementer, CISA, CISM, CRISC, CISSP, CGEIT, ISO 22301 Lead Auditor / Lead Implementer, ISO/IEC 42001 Lead Auditor / Lead Implementer, COBIT, CCSP, CCSK, or relevant privacy certifications will be an advantage.
• Experience in client-facing consulting or professional services is highly preferred.
• Strong knowledge of information security governance, cybersecurity risk management, compliance, audit, and control assessment.
• Hands-on experience conducting cybersecurity risk assessments, gap assessments, internal audits, maturity assessments, regulatory compliance reviews, or control effectiveness assessments.
• Ability to manage multiple project sand deliver within the agreed timeline
• Attention to detail, analytical and problem-solving capabilities
• Excellent written, oral communication and presentation skills. (English is required. Bahasa / Chinese is an advantage.)
• Preferably holding certifications such as ISO 27001: Lead Auditor, CISA, CISSP, CISM, CCISO, etc., is an added advantage

Responsibilities

• Deliver Information Security GRC consulting engagements from planning through reporting.
• Conduct cybersecurity governance, risk, compliance, maturity, and control assessments.
• Perform information security and cybersecurity risk assessments.
• Conduct regulatory and standards-based gap assessments.
• Perform cybersecurity audits, internal audits, and independent control assessments.
• Assess the design adequacy and operating effectiveness of cybersecurity controls.
• Conduct stakeholder interviews, walkthroughs, workshops, and evidence reviews.
• Identify control gaps, risks, weaknesses, and areas for improvement.
• Develop practical and risk-based recommendations for clients.
• Prepare professional assessment reports, audit reports, risk registers, compliance reports, management presentations, and remediation roadmaps.
• Develop and review information security policies, procedures, standards, and governance frameworks.
• Conduct cybersecurity maturity assessments and develop improvement roadmaps.
• Conduct third-party and supplier cybersecurity risk assessments.
• Support certification and regulatory compliance readiness activities.
• Track project activities, information requests, findings, risks, and deliverables.
• Manage assigned engagement workstreams and ensure activities are completed within agreed timelines.
• Present assessment findings and recommendations to client stakeholders and management.
• Review work performed by Consultants and Junior Consultants.
• Mentor and guide junior members of the GRC delivery team.
• Maintain high standards of quality, confidentiality, professionalism, and integrity throughout all engagements.
• To assist any other related duties as may be assigned from time to time by the company

Skills

GRC experience

Client-facing

Regulatory frameworks

Security audits

Education

Bachelor's Degree in Cybersecurity or related

Job description

EC-Council is seeking a Senior Consultant – Information Security GRC to join our Kuala Lumpur team. You will lead client-facing engagements, assess governance, risk, and compliance, and deliver high-quality reports across industries.

This role requires strong communication, stakeholder management, and hands-on risk assessment experience. The candidate should have 4–7 years in GRC or security consulting, professional certifications, and the ability to mentor junior staff while delivering multiple