Information Security Officer GRC

About the job
Purpose: 
The Information Security GRC Coordinator supports the day-to-day execution of Information Security Governance, Risk and Compliance activities across the Group. The role performs administrative, coordination, tracking, reporting, and documentation activities that enable the effective operation of the Information Security GRC function.
The position works closely with Information Security, Technology, Risk Management, Compliance, Internal Audit, and business stakeholders to coordinate security governance activities, maintain risk and compliance records, monitor action plans, support reporting requirements, and assist with security awareness and regulatory compliance initiatives.
This is a junior role intended to provide practical exposure to cybersecurity governance, risk management, compliance, audit, and control assurance activities.Key Responsibilities & Main Duties: 
Governance Administration
Maintain Information Security policies, standards, procedures, and governance documentation repositories.
Track policy review schedules and coordinate policy review and approval activities.
Assist with the publication and communication of approved security policies and standards.
Maintain records of governance committee meetings, actions, and decisions.
Coordinate stakeholder feedback during policy review exercises.
Track completion of governance-related action items.

Cyber Risk Management Support
Maintain and update the Information Security Risk Register.
Record new risks, risk treatment plans, risk acceptances, and risk exceptions.
Follow up with risk owners regarding overdue remediation actions.
Coordinate information gathering for risk assessments.
Assist in preparing risk reports, dashboards, and committee submissions.
Track remediation progress and escalate overdue actions to management.

Internal Control System (ICS) Coordination
Maintain inventories of Information Security processes, risks, controls, and control owners.
Coordinate periodic reviews of ICS processes and controls.
Obtain evidence and documentation from control owners.
Track review schedules and remind stakeholders of upcoming review deadlines.
Update control documentation based on approved changes.
Support management reporting on control review status and remediation progress.
Maintain records of control attestations and supporting evidence.

Compliance & Regulatory Support
Assist with security compliance assessments and reviews.
Maintain compliance obligation registers and regulatory tracking logs.
Track regulatory findings, audit observations, and remediation activities.
Coordinate evidence collection for regulatory examinations and compliance reviews.
Support implementation tracking of new regulatory requirements.
Prepare documentation required for audits and regulatory engagements.

Security Assurance & Audit Coordination
Schedule and coordinate internal and external audit activities.
Collect and organize evidence requested during audits.
Maintain audit issue and finding registers.
Follow up with action owners to ensure timely closure of findings.
Track remediation progress and provide regular status updates.
Support control effectiveness reviews and testing activities.

Reporting & Metrics
Compile and maintain GRC dashboards, metrics, KRIs, and KPIs.
Prepare weekly and monthly status reports.
Assist with the preparation of management presentations and committee reports.
Maintain reporting data sources and tracking mechanisms.
Ensure accuracy and completeness of reporting information.

Third-Party Risk Coordination
Coordinate collection of vendor security assessment questionnaires.
Track completion of supplier due diligence reviews.
Maintain third-party security risk records and documentation.
Follow up on supplier remediation actions and outstanding issues.
Assist in preparing supplier risk reports.

Security Awareness & Culture Support
Coordinate security awareness campaigns and communications.
Track completion of mandatory security awareness training.
Assist with phishing simulation campaigns and reporting.
Maintain awareness program metrics and attendance records.
Support awareness events and cybersecurity initiatives across the Group.

Stakeholder Coordination
Serve as a central coordination point for GRC activities.
Arrange meetings, workshops, and review sessions.
Track actions arising from governance, risk, and compliance forums.
Maintain communication with stakeholders regarding deadlines and deliverables.
Support coordination of Group-wide security initiatives.

Education
Bachelor's Degree in Information Security, Computer Science, Information Technology, Risk Management, Business Administration, or a related field.

Professional CertificationsDesirable but not mandatory:
Security+
ISO 27001 Foundation
COBIT Foundation
ITIL Foundation
Certified in Cybersecurity (CC)
CRISC (Associate level)
CISA (Associate level)

Experience
1-3 years experience in Information Security, IT Risk, Compliance, Audit, IT Operations, Governance, or related disciplines.
Experience maintaining documentation, reports, registers, or compliance records.
Exposure to regulated environments is beneficial but not required.
Recent graduates with relevant internships may be considered.