Information Security GRC Specialist (Manager Potential) Security Governance Section (RMI Telecommunication Security Supervisory Dep)

Job Description:

About Organization

The Security Governance function is responsible for strengthening information security governance risk management regulatory resilience AI security and governance and assurance across the organization.

The Digital Trust & Regulatory Resilience (DTRR) section provides an integrated governance capability across cyber security data privacy AI regulatory compliance assurance human risk and enterprise risk intelligence.

DTRR operates through six interconnected strategic pillars: Data Trust Privacy & Protection Governance; Adaptive Compliance & Regulatory Intelligence; Intelligent Governance & Policy Automation; Human Risk & Security Culture; AI Security & Responsible AI Governance; and Integrated Cyber Risk Intelligence.

The function is supported by strategic capabilities including DTDPG - Digital Trust Data Product Governance DTRC - Digital Trust Regulatory Compliance DTAM - Digital Trust Assurance Model DTEN - Digital Trust Enablement Network DTARG - Digital Trust AI & Responsible Governance and DTRIM - Digital Trust Risk Intelligence Management.

Job Duties

The Information Security GRC Specialist is an experienced individual contributor and cross-pillar enabling role. The role does not replace the accountability of DTRR Pillar Leads and is not accountable for the strategic ownership of DTAM DTEN DTDPG DTRC DTARG or DTRIM.

Operating flow: Requirements -> Governance -> Controls & Processes -> Business Practices -> Adoption & Evidence -> Continuous Improvement

The role serves as an important connective capability between DTAM and DTEN while providing practical GRC support across the wider DTRR operating model.

Work across the DTRR pillars to support the implementation and continuous improvement of the Digital Trust & Regulatory Resilience operating model.
Provide hands-on governance risk and compliance support to DTRR Pillar Leads helping translate strategic objectives into practical processes controls standards procedures and operational guidance.
Provide primary cross-functional support to DTAM - Digital Trust Assurance Model including control framework development control mapping evidence requirements assessment processes remediation tracking control maturity and assurance activities.
Support the development review maintenance and continuous improvement of information security policies standards procedures operational manuals and governance processes.
Support policy and standards lifecycle management including periodic reviews stakeholder consultation change impact assessment approval preparation communication and implementation tracking.
Support the development and adoption of governance automation capabilities including workflow automation and AI-assisted policy standards control and evidence review processes.
Assist in translating regulatory security data privacy AI and business requirements into practical controls and governance processes.
Support the maintenance and evolution of the DTRR control framework including mapping requirements from ISO/IEC 27001 ISO/IEC 27002 ISMS ISMAP and other applicable standards and regulatory frameworks.
Support ISMS and ISMAP readiness activities including control reviews evidence preparation gap identification remediation tracking internal assessments and audit coordination.
Support the DTRR exception management process including intake assessment documentation compensating controls approval routing expiration monitoring remediation tracking and closure.
Support internal and external assurance activities by coordinating evidence control-owner responses remediation actions and audit readiness across relevant stakeholders.
Provide primary cross-functional support to DTEN - Digital Trust Enablement Network helping translate governance requirements into practical guidance communications awareness training and business enablement activities.
Support and coach Trust Enablement Representatives and other business stakeholders in understanding their responsibilities for security data privacy AI risk and regulatory governance.
Help develop role-based guidance and enablement materials for control owners business owners data owners data stewards technical custodians product owners and other governance stakeholders.
Support security and Digital Trust awareness initiatives that strengthen organizational understanding of security data protection responsible AI regulatory obligations and risk accountability.
Identify recurring areas of misunderstanding control failure process friction or poor adoption and work with DTAM DTEN and the relevant Pillar Lead to improve the underlying governance process.
Support DTDPG - Digital Trust Data Product Governance by helping operationalize data governance processes data classification and handling requirements ownership and stewardship responsibilities HPDU governance cloud data governance and HLD-related governance requirements.
Support DTRC - Digital Trust Regulatory Compliance by helping translate regulatory requirements into controls policies standards processes evidence requirements and organizational guidance.
Support DTARG - Digital Trust AI & Responsible Governance through AI policy and standards development AI governance processes risk assessment support ISO/IEC 42001 alignment responsible AI awareness and integration of AI governance requirements into DTAM and DTEN.
Support DTRIM - Digital Trust Risk Intelligence Management by contributing consistent control assurance exception adoption and governance data for risk intelligence KPI/KRI measurement and management reporting.
Support development and improvement of internal DTRR processes ensuring activities are clearly documented repeatable scalable and aligned with defined roles and decision rights.
Facilitate cross-pillar working sessions to identify dependencies clarify responsibilities resolve governance gaps and coordinate activities requiring multiple DTRR capabilities.
Support Security High-Level Design and other governance review processes where DTRR involvement is required helping identify applicable data privacy security AI regulatory and control requirements.
Support incident-response governance where required including coordination of governance actions control impact reviews remediation tracking lessons learned and translation of incident findings into policy control process or awareness improvements.
Support governance metrics and reporting by helping define collect validate and improve KPIs and KRIs relating to control effectiveness exceptions assurance adoption policy health remediation and governance maturity.
Identify opportunities to simplify standardize and automate GRC activities while maintaining appropriate governance accountability evidence and human oversight.
Maintain awareness of emerging information security regulatory AI data protection risk and governance practices and help assess their relevance to DTRR.
Build collaborative relationships across Security Technology Business Units Privacy Legal Compliance Internal Audit Cloud Data AI and other relevant functions to support consistent adoption of DTRR requirements.
Promote a culture of practical governance shared accountability continuous improvement and Digital Trust across the organization.

Minimum Qualification
Bachelors degree in Information Technology Law Finance Cybersecurity Engineering or a related field. An advanced degree (Masters or higher) in a relevant discipline such as an MBA or Cybersecurity is highly preferred.
Relevant professional certifications such as CISA CISM CRISC CISSP CGEIT ISO/IEC 27001 ISO/IEC 42001 NIST CSF or other qualifications demonstrating expertise across GRC information security risk compliance or Digital Trust domains are good to have.
7-12 years of progressive experience in Governance Risk Management Information Security and/or Compliance roles with experience supporting significant programs developing the capabilities of others or assuming responsibility for key program components.
Proven experience working within or alongside teams of GRC professionals including experience coaching mentoring supporting development and improving team or stakeholder capability.
Broad understanding across multiple GRC domains including security risk management compliance management policy and standards management third-party risk business continuity information security governance assurance and control management.
Strong experience with GRC technology platforms and governance automation; experience with leading GRC compliance automation workflow or control-management platforms is a significant advantage.

Strong critical thinking leadership problem-solving and influencing skills with the ability to operate effectively across organizational and functional boundaries.
Excellent verbal and written communication presentation facilitation and interpersonal skills with the ability to translate complex technical risk security and regulatory information for diverse audiences including non-technical stakeholders and executives.
Demonstrated ability to manage multiple priorities projects dependencies and stakeholders within a fast-paced and evolving environment.
Ability to work as a senior individual contributor provide guidance and coaching to others and influence outcomes without requiring direct management authority.

Languages: