IT/IS GRC Analyst — ISO 27001 & Risk

PARCO - Pak-Arab Refinery Limited; Karachi Division; On-site; PKR 2,400,000 - 4,200,000; Full time

Job summary

Pak-Arab Refinery Limited (PARCO) is seeking an IT/IS Governance Analyst (Contractual) to support the organization’s GRC program, including ISO/IEC 27001:2022 compliance, risk assessment, audit coordination, and policy governance.

Based in Karachi, the role requires collaboration with IT, business, audit, and risk teams to drive remediation, dashboards, and governance reporting while maintaining regulatory alignment.

Qualifications

• Strong analytical, documentation, and report-writing capabilities.
• Effective communication, coordination, and stakeholder-management skills.
• Experience with ISO/IEC 27001-based ISMS and IT/IS risk management.

Responsibilities

• Monitor compliance with information security policies and ISO/IEC 27001:2022.
• Coordinate IT/IS risk assessments, risk registers, and treatment plans.
• Coordinate internal and external information security audits and evidence collection.
• Track audit observations and remediation through closure.
• Develop, review, and maintain information security policies and governance docs.
• Plan and deliver cybersecurity awareness activities and phishing simulations.
• Prepare dashboards and management reports covering risks and compliance.
• Stay updated on cybersecurity standards and regulations.

Skills

Analytical skills

Documentation

Report writing

Communication

Stakeholder management

Cross-functional collaboration

Regulatory interpretation

GRC platforms/tools

Education

Bachelor's degree in Information Security/CS/IT

Tools

GRC platforms/tools

Job description

Pak-Arab Refinery Limited (PARCO) is seeking an IT/IS Governance Analyst (Contractual) to support the organization’s GRC program, including ISO/IEC 27001:2022 compliance, risk assessment, audit coordination, and policy governance.

Based in Karachi, the role requires collaboration with IT, business, audit, and risk teams to drive remediation, dashboards, and governance reporting while maintaining regulatory alignment.