Governance, Risk, and Compliance (GRC) Specialist

Starlink Qatar; Doha; Sur place; QAR 240 000 - 360 000; Plein temps

Résumé du poste

Starlink Qatar seeks an experienced Information Security Governance, Risk & Compliance Specialist to strengthen the organization’s cybersecurity governance framework in Qatar. You will drive information security governance initiatives, manage enterprise security risks, and support audits with a focus on ISO/IEC 27001, NIA, PCI-DSS, and data privacy.

You will collaborate with business and technology teams, auditors, and regulators to ensure effective security controls and ongoing regulatory

Qualifications

• Bachelor's degree in Information Technology, Cybersecurity, or related field.
• 5–8 years in information security governance, risk management, compliance, or audits.
• Hands-on ISMS experience based on ISO/IEC 27001.
• Experience with Qatar NIA framework and PCI-DSS compliance.
• Strong data privacy, risk assessment, and control testing knowledge.

Responsabilités

• Lead ISMS governance aligned with ISO/IEC 27001 and maintain docs.
• Drive risk assessments across technology, processes, and cloud.
• Coordinate audits, evidence collection, and remediation tracking.
• Develop and monitor compliance with policies and standards.
• Produce executive dashboards and governance reports.
• Coordinate ICOFR reviews and control testing activities.
• Collaborate with stakeholders, auditors, and regulators.

Connaissances

GRC frameworks

ISO 27001

NIA compliance

PCI‑DSS

Data privacy

Risk management

Internal controls

Audits

Executive reporting

Stakeholder management

ISMS implementation

Regulatory compliance

Formation

Bachelor's degree in Information Technology/Cybersecurity

Outils

GRC platforms

Description du poste

We are seeking an experienced Information Security Governance, Risk & Compliance (GRC) Specialist to strengthen the organization's cybersecurity governance framework and ensure compliance with local and international regulatory requirements. The successful candidate will be responsible for driving information security governance initiatives, managing enterprise security risks, maintaining compliance with industry standards, supporting audits, and ensuring the effectiveness of security controls across the organization.

This role requires strong expertise in ISO 27001, Qatar National Information Assurance (NIA), PCI-DSS, data privacy, risk management, and internal control frameworks, while working closely with business stakeholders, technology teams, auditors, and regulators.

Key Responsibilities

Information Security Governance

• Support the implementation, maintenance, and continual improvement of the organization's Information Security Management System (ISMS) aligned with ISO/IEC 27001.
• Develop, review, and maintain information security policies, standards, procedures, and governance documentation.
• Monitor compliance with internal security policies, regulatory requirements, and industry best practices.
• Promote security governance and security awareness across the organization.

Risk Management

• Conduct enterprise information security risk assessments across technology, applications, infrastructure, cloud services, and business processes.
• Maintain the organization's cybersecurity risk register and ensure timely risk treatment activities.
• Facilitate risk identification workshops with business and technology stakeholders.
• Monitor risk mitigation plans and provide regular reporting to management.

Compliance Management

Lead and support compliance initiatives related to:

• ISO/IEC 27001
• Qatar National Information Assurance (NIA)
• PCI-DSS
• Data Privacy and Protection requirements
• Perform compliance assessments, control reviews, gap analyses, and remediation tracking.
• Coordinate certification readiness activities and ensure ongoing compliance.

Audit & Assurance

• Coordinate internal audits, external audits, certification audits, and regulatory assessments.
• Prepare audit evidence and validate documentation supporting security controls.
• Review technical evidence from infrastructure, cloud environments, applications, security platforms, and business systems to determine control effectiveness.
• Track audit findings and ensure timely remediation and closure.

Internal Controls

• Support ICOFR (Internal Controls over Financial Reporting) reviews and control testing activities.
• Coordinate remediation efforts with business and technology teams.
• Ensure security controls align with financial reporting and governance requirements.

Reporting & Stakeholder Management

• Prepare executive dashboards, governance reports, compliance reports, audit reports, and cybersecurity risk reports.
• Present findings, recommendations, and compliance status to senior management and key stakeholders.
• Work collaboratively with internal teams, external auditors, regulators, and third-party service providers.
• Provide guidance on governance, risk, and compliance best practices across the organization.

Required Qualifications

• Bachelor's degree in Information Technology, Computer Science, Cybersecurity, Information Security, Risk Management, or a related discipline.
• 5–8 years of experience in Information Security Governance, Risk Management, Compliance, Internal Controls, Information Security Audit, or Cybersecurity.
• Hands‑on experience implementing, maintaining, or managing Information Security Management Systems (ISMS) based on ISO/IEC 27001.
• Proven experience implementing and maintaining compliance with the Qatar National Information Assurance (NIA) framework.
• Experience managing PCI‑DSS compliance, including gap assessments, remediation planning, certification readiness, and audit support.
• Strong understanding of Data Privacy and Protection requirements, privacy risk assessments, and personal data handling controls.
• Experience conducting information security risk assessments, developing risk treatment plans, and maintaining risk registers.
• Experience supporting ICOFR assessments, internal control testing, remediation activities, and audit coordination.
• Experience coordinating internal audits, external audits, certification audits, and regulatory compliance assessments.
• Strong knowledge of evaluating audit evidence from technology platforms, cloud environments, security tools, infrastructure, applications, and business systems.
• Experience working with Governance, Risk & Compliance (GRC) platforms and compliance management tools is an advantage.
• Excellent analytical, documentation, reporting, communication, presentation, and stakeholder management skills.
• Ability to produce executive-level dashboards, compliance reports, governance reports, and risk reports.

Preferred Certifications

One or more of the following certifications are preferred:

• ISO/IEC 27001:2022 Lead Auditor
• ISO/IEC 27001:2022 Lead Implementer
• Certified Information Security Manager (CISM)
• Certified in the Governance of Enterprise IT (CGEIT)
• Certified Information Systems Security Professional (CISSP)

Key Competencies

• Information Security Governance
• Cybersecurity Risk Management
• Enterprise Risk Assessment
• ISO/IEC 27001 ISMS
• Qatar National Information Assurance (NIA)
• PCI‑DSS Compliance
• Data Privacy & Protection
• Internal Controls (ICOFR)
• Information Security Audit
• Regulatory Compliance
• Governance, Risk & Compliance (GRC)
• Security Policies & Standards
• Audit Management
• Compliance Monitoring
• Gap Analysis
• Risk Registers
• Control Assessment
• Executive Reporting
• Stakeholder Management
• Technical Documentation