Senior Administrator - ISO 27001:2005, ISMS

Job Summary

We are looking for an experienced and detail-oriented Governance, Risk, and Compliance (GRC) Professional to strengthen the organization's information security posture and ensure compliance with industry standards and regulatory requirements. The ideal candidate will have hands-on experience in ISO/IEC 27001, PCI-DSS, third-party risk management, security risk assessments, and compliance audits.

The role involves managing client information security requirements, coordinating internal and external audits, developing security policies and procedures, and collaborating with cross-functional teams to ensure effective risk management and regulatory compliance.

Key Responsibilities

Key Responsibilities

1. Compliance and Security Standards

• Implement, maintain, and monitor compliance with ISO/IEC 27001 and PCI-DSS requirements.
• Support alignment with SOC 2, NIST, and other relevant security frameworks, where applicable.
• Review client information security requirements, contractual security clauses, and vendor agreements.
• Coordinate internal compliance assessments and external audits, track findings, and ensure timely remediation of gaps.
• Maintain compliance with documentation, audit evidence, policies, and control records.

2. Risk Management and Governance

• Conduct IT, information security, and operational risk assessments and maintain the organization's risk register.
• Manage third-party risk management (TPRM), including vendor security assessments, risk reviews, and compliance monitoring.
• Review and evaluate vendor security questionnaires and identify potential security gaps.
• Develop, review, and maintain information security policies, standards, procedures, and governance of workflows.
• Track identified risks, control deficiencies, and corrective action plans through closure.
• Support client and vendor security due diligence activities.

3. Reporting and Stakeholder Management

• Develop compliance reports, risk dashboards, KPIs, and metrics to communicate the security posture to management.
• Coordinate with internal teams, clients, vendors, and external auditors to address security and compliance requirements.
• Prepare professional reports, presentations, audit summaries, and management updates.
• Provide guidance to stakeholders on security controls, compliance requirements, and risk mitigation measures.
• Contribute to information security awareness initiatives and compliance training.

Skill Requirements

Qualifications and Requirements

• 5–8 years of relevant experience in Governance, Risk, and Compliance (GRC), information security, IT risk management, or security compliance.
• Hands-on experience with ISO/IEC 27001 and PCI-DSS frameworks.
• Practical knowledge of third-party risk management, security risk assessments, and compliance audits.
• Experience reviewing client security questionnaires, vendor assessments, contractual security clauses, and security addendums.
• Strong understanding of risk registers, control assessments, remediation tracking, and audit evidence management.
• Experience in preparing and maintaining security policies, procedures, compliance reports, and presentation decks.
• Excellent written and verbal communication skills with the ability to work effectively across cross-functional teams.
• Ability to independently manage deliverables, coordinate stakeholders, and meet compliance deadlines.

Other Requirements

Preferred Qualifications

• Experience in financial services, fintech, banking, or other regulated industries.
• Relevant certifications such as:
  • ISO/IEC 27001 Lead Implementer or Lead Auditor
  • CISA – Certified Information Systems Auditor
  • CRISC – Certified in Risk and Information Systems Control
  • CISM – Certified Information Security Manager
  • CISSP – Certified Information Systems Security Professional
• Familiarity with SOC 2, NIST Cybersecurity Framework, and other applicable regulatory or security standards.