About this role
CapitalSage Holdings | Full time
Role Purpose: Support the implementation and ongoing management of the Group's information security governance, risk and compliance activities, ensuring that security controls, policies and regulatory requirements are effectively monitored, documented and maintained.
Key Responsibilities
- Support the implementation and maintenance of information security policies, standards, procedures and control frameworks.
- Assist with information security and cybersecurity risk assessments and maintain the Group's risk register.
- Support compliance assessments against applicable regulatory, contractual and industry requirements.
- Coordinate the collection, validation and maintenance of audit and compliance evidence.
- Support internal and external information security audits and regulatory assessments.
- Assist with the implementation and maintenance of the Information Security Management System (ISMS) and ISO 27001 requirements.
- Track security control effectiveness, compliance gaps, audit findings and remediation actions.
- Maintain accurate records of security policies, controls, risks, exceptions and compliance obligations.
- Support third-party/vendor security assessments and due diligence activities.
- Prepare periodic GRC reports, dashboards, KPIs and KRIs for management review.
- Support information security awareness, policy compliance and staff communication activities.
- Monitor changes in applicable cybersecurity, data protection and regulatory requirements and escalate relevant impacts.
- Follow up with control owners and stakeholders on outstanding remediation and compliance actions.
Requirements
-
Relevant degree or equivalent professional qualification in Cybersecurity, Information Technology, Computer Science, Engineering or a related discipline.
-
Relevant professional certifications will be an advantage and should align with the specific role.
-
Demonstrable practical experience relevant to the position.
-
Strong communication, analytical, documentation and stakeholder-management skills.
-
Ability to operate in a regulated, technology-driven and multi-business environment.
-
Preferred / Added Advantage Certifications
-
ISO/IEC 27001 Foundation / Internal Auditor – preferred
-
CISA – Certified Information Systems Auditor – advantage
-
CRISC – Certified in Risk and Information Systems Control – advantage
-
ISO/IEC 27001 Lead Implementer or Lead Auditor – advantage
-
CISM – Certified Information Security Manager – advantage
-
Data Protection/Privacy certification or training – advantage
-
PCI DSS training/certification – advantage
Benefits
- Industry Standard