Associate Manager, IT - Governance, Risk & Compliance

Job description

You will play a critical role in strengthening and maintaining our organization's security posture. You will be responsible for managing the life cycle of security policy exceptions, assisting with third-party security risk assessments and continuous control maturity assessments and manage the security metrics program. What's on the menu? Manage and monitor the central GRC and security mailbox, acting as the first line of response for employee inquiries.

Administer the security policy exception lifecycle from initial request to final approval, extension, or remediation. Review incoming exception requests to evaluate business justification against potential security risks. Maintain the centralised security exceptions register, proactively tracking expiration dates and initiating review processes before the exceptions lapse. Conduct reviews of vendor security documentation, including SOC 2 type 2 reports, ISO 27,001 certificates, penetration test summaries, and custom security questionnaires.

Identify, document, and communicate third party risks to business owners, and track vendor remediation efforts for any identified control gaps. Collaborate with procurement and legal teams to ensure appropriate data protection and information security clauses are embedded in vendor contracts. Initiate, conduct and manage cyber controls maturity assessments.