Executive - Process Compliance

Role & responsibilities

• Support the implementation, maintenance and continual improvement of the organization's ISMS and PIMS in accordance with applicable ISO/IEC 27001 and ISO/IEC 27701 requirements.
• Coordinate ISO 27001 and ISO 27701 internal and external audit activities, including audit planning, evidence collection, documentation and follow-up.
• Support SOC 1 and SOC 2 audit activities by coordinating evidence collection, control documentation and audit queries with relevant stakeholders.
• Maintain and update policies, procedures, SOPs, process narratives, control documents and compliance records.
• Support information security and privacy risk assessments, Risk Register updates, Statement of Applicability (SoA) maintenance and risk treatment activities. Coordinate audit findings, observations, Root Cause Analysis (RCA), Corrective Action Plans (CAPA) and closure tracking.
• Support PIMS activities including PII inventory, PII classification, DPIA coordination, privacy control implementation and evidence management.
• Track compliance activities, audit actions and control implementation status and prepare periodic compliance reports and dashboards.
• Coordinate with IT, HR, Operations, Legal, Information Security, Privacy and other business stakeholders for compliance requirements and audit evidence. Support customer, vendor and third-party security/privacy questionnaires and compliance assessments.
• Assist in maintaining compliance records and audit evidence in designated repositories such as SharePoint.
• Support awareness and compliance training activities related to information security, privacy and applicable standards.
• Monitor changes in applicable standards, regulatory requirements and organizational policies and support necessary updates.

Preferred candidate profile

• 2 to 5 years of relevant experience in Information Security Compliance, GRC, ISMS/PIMS, ISO 27001/ISO 27701 implementation or audit coordination.
• Experience in SOC 1/SOC 2 audit coordination will be an added advantage.
• Good working knowledge of ISO/IEC 27001:2022 and ISO/IEC 27701. Practical experience in ISMS/PIMS implementation, maintenance and audit coordination.
• Working knowledge of SOC 1 and SOC 2 audit requirements and evidence management.
• Experience in risk assessment, Risk Register, risk treatment plans and Statement of Applicability (SoA).
• Experience in preparing and maintaining information security/privacy policies, procedures, SOPs and process documentation.
• Experience in audit evidence collection, compliance tracking, Root Cause Analysis (RCA), Corrective and Preventive Actions (CAPA), and audit finding closure.
• Basic understanding of data protection, PII management, DPIA and privacy compliance requirements.
• Good knowledge of Microsoft Office, particularly Excel, Word and PowerPoint; working knowledge of SharePoint is desirable.
• Ability to coordinate with cross-functional teams and manage multiple compliance activities and deadlines.
• ISO 27001/ISO 27701 certification or relevant professional certification will be an added advantage.