Governance, Risk, and Compliance (GRC) Specialist

Logicalis Singapore Pte Ltd; Singapore; On-site; SGD 90,000 - 140,000; Full time

Job summary

Logicalis Singapore Pte Ltd is seeking an experienced GRC specialist to lead governance, risk and compliance across Singapore and Malaysia. You will manage ISMS/ISO frameworks, conduct risk assessments, coordinate audits, and monitor third‑party risk and regulatory changes.

You will also support incident response, business continuity planning and security awareness initiatives while reporting to management on GRC status. This role requires collaboration across regions and departments.

Qualifications

• Bachelor's degree in Information Security, Cybersecurity, IT, Risk Management or related field.
• 3–5 years in GRC, IT risk, IT audit, information security or compliance roles.
• Solid knowledge of ISO 27001/27701/42001 and at least one framework such as NIST CSF or COBIT.
• Hands-on experience with risk assessments, control testing and audit coordination.
• Familiarity with data protection regulations in Singapore and Malaysia PDPA.

Responsibilities

• Maintain and operationalise ISMS, PIMS and AIMS in line with ISO standards.
• Manage IT risk registers, risk assessments and treatment plans.
• Coordinate audits and track remediation to closure.
• Oversee third‑party risk assessments and vendor agreements.
• Support incident response, BC/DR planning, and regulatory reporting.
• Deliver security awareness and management reporting on GRC posture.

Skills

GRC management

Policy & controls

Risk assessment

Audit coordination

Regulatory compliance

Education

Bachelor's degree in Information Security or related field

Tools

AuditBoard

DiligentOne

Risk4All

Job description

About Us

At Logicalis Asia Pacific, this is where you belong, grow, and thrive — at one of APAC's leading AI-driven technology integrators.

As the Architects of Change™, we combine global expertise with local insight to help organisations accelerate their journey toward becoming AI-ready enterprises. With 7,000+ professionals across 30 territories and more than 10,000 clients worldwide, we deliver lifecycle services across cloud, connectivity, collaboration, cybersecurity, and managed services — providing real-time visibility and intelligence across our clients' digital ecosystems.

You'll belong as part of a collaborative regional team embedded within a global organisation. You'll grow through hands‑on experience with the world's leading technology partners, supported by investment in certifications, consulting capability, and cross‑border opportunity. And you'll thrive in a culture built on inclusion, trust, and continuous improvement.

Logicalis is proud to be a Great Place to Work® Certified™ organisation across multiple APAC markets — because the commitment we bring to our clients belongs equally to our people.

Join us and help shape the future of technology across APAC.

Job Responsibilities

1. Governance and Frameworks

• Maintain and operationalise the ISMS, PIMS and AIMS including policies, standards, procedures and controls, in line with ISO 27001, ISO 27701 & ISO42001.
• Ensure governance documentation is current, version‑controlled and aligned with relevant regulatory and industry standards (e.g. ISO 27001, ISO 27701, ISO42001, NIST CSF, Singapore and Malaysia PDPA).
• Act as the Subject Matter Expert on IT GRC, advising IT, business and project teams on policy, risk and control matters.
• Monitor adherence to internal security policies and drive adoption through training, communication and stakeholder engagement.

2. IT Risk Management

• Maintain the IT risk register and facilitate risk identification, assessment, treatment and monitoring across business and technology functions.
• Conduct periodic risk assessments covering infrastructure, applications, cloud services, data and third parties.
• Track risk treatment plans to completion and report on risk trends, emerging risks and control effectiveness.

3. Compliance and Certifications

• Manage ISO 27001/ISO27701/ISO42001 compliance and certification activities for all entities in Singapore and Malaysia, ensuring control requirements are met.
• Support compliance with frameworks and certifications relevant to the business, such as Singapore's Cyber Trust Mark and Data Protection Trustmark.
• Monitor regulatory developments, assess their impact on the organisation, and coordinate gap assessments and remediation.
• Track and report on security compliance metrics.

4. Controls and Audit

• Document and test key IT and information security controls to verify their design and operating effectiveness.
• Coordinate internal and external audits, including the Group cybersecurity internal audit, covering PBC list preparation, walkthroughs, evidence gathering and management responses, as the MR or Deputy MR.
• Track audit findings and remediation through to closure and report status to management.
• Maintain up-to-date information on the GRC platform for all entities.

5. Third-Party Risk

• Conduct vendor risk assessments and due diligence, particularly for critical, data-sensitive or outsourced services.
• Review client contracts and vendor agreements to ensure cybersecurity and risk‑related clauses are appropriately addressed.

6. Incident and Business Continuity Support

• Support incident response, investigations, root cause analysis and lessons learned for security incidents.
• Support timely reporting of security and data breach incidents to regulators and clients where required.
• Contribute to business continuity and disaster recovery planning, testing and reporting.

7. Awareness, Reporting and Stakeholder Engagement

• Develop and deliver information security awareness training and track staff completion of mandatory training.
• Prepare clear, concise reports for management on GRC status, key risks and compliance posture.
• Work with departments such as Legal and HR, and stakeholders across Singapore and Malaysia, occasionally with regional offices to ensure consistent compliance and document control.
• Stay updated on emerging security threats, regulatory developments and industry trends.
• Other ad-hoc tasks as assigned.

Required Traits

• Able to operate independently and own processes end-to-end with minimal supervision.
• Strong written and verbal communication, with the ability to translate technical and regulatory complexity into clear business language.
• Strong attention to detail and a structured, process‑driven approach.
• Good project management skills to coordinate security and compliance initiatives across teams.
• Collaborative team player, able to work effectively across departments and countries.

Required Qualifications

Essential

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, Risk Management or a related field.
• 3 to 5 years of combined experience across GRC, IT risk, IT audit, information security or compliance roles.
• Solid working knowledge of ISO 27001, ISO 27701 and ISO42001, CREST and at least one other framework such as NIST CSF or COBIT.
• Hands‑on experience running risk assessments, control testing and audit coordination.
• Working knowledge of data protection regulations, including Singapore and Malaysia PDPA.

Preferred

• Professional certifications such as ISO 27001/42001 Lead Auditor/Lead Implementer, CISA, CRISC or CISM.
• Experience with Cyber Trust Mark (CTM) or Data Protection Trustmark certification (DPTM).
• Familiarity with GRC tools (e.g. AuditBoard, DiligentOne, Risk4All, AON CyQu) and cloud platforms (M365, Azure, GWS & GCP).
• Exposure to GDPR and third‑party or outsourcing risk frameworks.
• Experience in a regulated industry or an IT services or managed services environment.

At Logicalis, we are committed to creating a diverse and inclusive workplace where everyone can thrive.