Information Security Engineer – GRC

About the role

The Information Security Engineer – GRC will support the organization’s governance, risk, and compliance program. You will work closely with security, audit, and business teams to ensure that security controls are designed, implemented, and monitored in line with industry standards.

Key responsibilities

• Assist in conducting risk assessments, developing treatment plans, and tracking remediation activities.
• Support the design, testing, implementation, and monitoring of security controls.
• Draft, maintain, and communicate security policies, standards, procedures, and guidelines.
• Coordinate audit activities, collect evidence, and support both internal and external auditors.
• Monitor compliance with frameworks such as ISO 27001, NIST, PCI DSS, and COBIT.
• Track security incidents, policy exceptions, corrective actions, and remediation efforts.
• Prepare compliance, risk, and security reports for management and auditors.
• Promote security awareness and communicate requirements to stakeholders.

Required profile

• Bachelor’s degree in Information Security, Cybersecurity, IT, Computer Science, Engineering, or Business.
• Practical understanding of GRC concepts, risk management, control design, audit coordination, and policy writing.
• Familiarity with ISO 27001, NIST, PCI DSS, and COBIT frameworks.
• Relevant certifications such as ISO 27001 Lead Implementer/Lead Auditor, CISSP, CISA, or CRISC are a plus.

Required skills

• ISO 27001
• NIST
• PCI DSS
• COBIT
• Risk assessment and treatment
• Security control design and monitoring
• Audit evidence collection and coordination