Governance, Risk, and Compliance (GRC) Manager

Logicalis Asia Pacific; Singapore; Presencial; SGD 80.000 - 120.000; Jornada completa

Descripción de la vacante

Logicalis Asia Pacific is seeking a Governance, Risk and Compliance (GRC) professional to lead IT risk, policy development, and assurance across Singapore and Malaysia. You will drive ISO 27001/27701/42001 compliance, coordinate audits, and manage third‑party risk in a regional role within a global organization.

You will partner with Legal, HR and IT to improve controls, reporting, and awareness, delivering stakeholder‑friendly risk insights and remediation plans across the APAC footprint.

Formación

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, Risk Management or a related field.
• 3–5 years of experience across GRC, IT risk, IT audit, information security or compliance roles.
• Solid working knowledge of ISO 27001, ISO 27701 and ISO42001, CREST and at least one other framework (NIST CSF or COBIT).
• Hands-on experience running risk assessments, control testing and audit coordination.
• Working knowledge of data protection regulations in Singapore and Malaysia (PDPA).

Responsabilidades

• Governance and Frameworks: maintain and operationalise the ISMS, PIMS and AIMS including policies, standards, procedures and controls. Ensure documentation is current and aligned with standards.
• Compliance and Certifications: manage ISO certifications for Singapore and Malaysia; support CTM and DPTM; monitor regulatory developments.
• Controls and Audit: document and test IT controls; coordinate internal and external audits; track findings and remediation.
• Third-Party Risk: conduct vendor risk assessments and due diligence; review client contracts and vendor agreements.
• Incident and Business Continuity Support: assist incident response, investigations, and BC/DR planning.
• Awareness, Reporting and Stakeholder Engagement: deliver security awareness training; report on GRC status; collaborate across departments and regions.

Conocimientos

GRC

IT risk

Audit coordination

Policy development

Stakeholder management

Educación

Bachelor's degree in Information Security / Cybersecurity / IT

Herramientas

AuditBoard

DiligentOne

Risk4All

AON CyQu

Descripción del empleo

At Logicalis Asia Pacific, this is where you belong, grow, and thrive — at one of APAC's leading AI-driven technology integrators.

As the Architects of Change™, we combine global expertise with local insight to help organisations accelerate their journey toward becoming AI-ready enterprises. With 7,000+ professionals across 30 territories and more than 10,000 clients worldwide, we deliver lifecycle services across cloud, connectivity, collaboration, cybersecurity, and managed services — providing real-time visibility and intelligence across our clients' digital ecosystems.

You'll belong as part of a collaborative regional team embedded within a global organisation. You'll grow through hands-on experience with the world's leading technology partners, supported by investment in certifications, consulting capability, and cross-border opportunity. And you'll thrive in a culture built on inclusion, trust, and continuous improvement.

Logicalis is proud to be a Great Place to Work® Certified™ organisation across multiple APAC markets — because the commitment we bring to our clients belongs equally to our people.

Join us and help shape the future of technology across APAC.

Job Responsibilities:

1. Governance and Frameworks

• Maintain and operationalise the ISMS, PIMS and AIMS including policies, standards, procedures and controls, in line with ISO 27001, ISO 27701 & ISO42001.
• Ensure governance documentation is current, version-controlled and aligned with relevant regulatory and industry standards (e.g. ISO 27001, ISO 27701, ISO42001, NIST CSF, Singapore and Malaysia PDPA).
• Act as the Subject Matter Expert on IT GRC, advising IT, business and project teams on policy, risk and control matters.
• Monitor adherence to internal security policies and drive adoption through training, communication and stakeholder engagement.
• Maintain the IT risk register and facilitate risk identification, assessment, treatment and monitoring across business and technology functions.
• Conduct periodic risk assessments covering infrastructure, applications, cloud services, data and third parties.
• Track risk treatment plans to completion and report on risk trends, emerging risks and control effectiveness.

3. Compliance and Certifications

• Manage ISO 27001/ISO27701/ISO42001 compliance and certification activities for all entities in Singapore and Malaysia, ensuring control requirements are met.
• Support compliance with frameworks and certifications relevant to the business, such as Singapore's Cyber Trust Mark and Data Protection Trustmark.
• Monitor regulatory developments, assess their impact on the organisation, and coordinate gap assessments and remediation.
• Track and report on security compliance metrics.

4. Controls and Audit

• Document and test key IT and information security controls to verify their design and operating effectiveness.
• Coordinate internal and external audits, including the Group cybersecurity internal audit, covering PBC list preparation, walkthroughs, evidence gathering and management responses, as the MR or Deputy MR.
• Track audit findings and remediation through to closure and report status to management.
• Maintain up-to-date information on the GRC platform for all entities.

5. Third-Party Risk

• Conduct vendor risk assessments and due diligence, particularly for critical, data-sensitive or outsourced services.
• Review client contracts and vendor agreements to ensure cybersecurity and risk-related clauses are appropriately addressed.

6. Incident and Business Continuity Support

• Support incident response, investigations, root cause analysis and lessons learned for security incidents.
• Support timely reporting of security and data breach incidents to regulators and clients where required.
• Contribute to business continuity and disaster recovery planning, testing and reporting.

7. Awareness, Reporting and Stakeholder Engagement

• Develop and deliver information security awareness training and track staff completion of mandatory training.
• Prepare clear, concise reports for management on GRC status, key risks and compliance posture.
• Work with departments such as Legal and HR, and stakeholders across Singapore and Malaysia, occasionally with regional offices to ensure consistent compliance and document control.
• Stay updated on emerging security threats, regulatory developments and industry trends.
• Other ad-hoc tasks as assigned.

Required Traits:

• Able to operate independently and own processes end-to-end with minimal supervision.
• Strong written and verbal communication, with the ability to translate technical and regulatory complexity into clear business language.
• Strong attention to detail and a structured, process-driven approach.
• Good project management skills to coordinate security and compliance initiatives across teams.
• Collaborative team player, able to work effectively across departments and countries.

Required Qualifications:

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, Risk Management or a related field.
• 3 to 5 years of combined experience across GRC, IT risk, IT audit, information security or compliance roles.
• Solid working knowledge of ISO 27001, ISO 27701 and ISO42001, CREST and at least one other framework such as NIST CSF or COBIT.
• Hands-on experience running risk assessments, control testing and audit coordination.
• Working knowledge of data protection regulations, including Singapore and Malaysia PDPA.

Preferred:

• Professional certifications such as ISO 27001/42001 Lead Auditor/Lead Implementer, CISA, CRISC or CISM.
• Experience with Cyber Trust Mark (CTM) or Data Protection Trustmark certification (DPTM).
• Familiarity with GRC tools (e.g. AuditBoard, DiligentOne, Risk4All, AON CyQu) and cloud platforms (M365, Azure, GWS & GCP).
• Exposure to GDPR and third-party or outsourcing risk frameworks.
• Experience in a regulated industry or an IT services or managed services environment.