Governance, Risk and Compliance (GRC) Specialist

About the role

Logicalis Asia Pacific, an AI-driven technology integrator with 7,000+ professionals across 30 territories, is hiring a Governance, Risk and Compliance (GRC) Specialist based in Mapletree Business City, Singapore. The role sits within a regional team and covers IT security governance, risk management, compliance and audit for entities in Singapore and Malaysia.

Key responsibilities

• Maintain and operationalise the ISMS, PIMS and AIMS, including policies, standards, procedures and controls, in line with ISO 27001, ISO 27701 and ISO 42001, and keep governance documentation current and version-controlled.
• Act as subject matter expert on IT GRC, advising IT, business and project teams, and monitor adherence to security policies through training and stakeholder engagement.
• Maintain the IT risk register, run periodic risk assessments and track risk treatment plans to completion.
• Manage ISO 27001/27701/42001 compliance and certification for Singapore and Malaysia, support the Cyber Trust Mark and Data Protection Trustmark, and coordinate gap assessments and remediation.
• Document and test controls, coordinate internal and external audits (including the Group cybersecurity internal audit) as MR or Deputy MR, and track findings to closure.
• Conduct vendor risk assessments and review client and vendor contracts for cybersecurity clauses.
• Support incident response, investigations, root cause analysis and reporting of breaches to regulators and clients, and contribute to business continuity and disaster recovery planning.
• Deliver information security awareness training, prepare management reports on GRC status and risks, and work with Legal, HR and other departments.

Required profile

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, Risk Management or a related field.
• 3 to 5 years of combined experience in GRC, IT risk, IT audit, information security or compliance roles.
• Able to work independently and own processes end-to-end, with strong written and verbal communication and attention to detail.

Required skills

• Solid working knowledge of ISO 27001, ISO 27701 and ISO 42001, CREST and at least one other framework such as NIST CSF or COBIT.
• Hands-on experience running risk assessments, control testing and audit coordination.
• Working knowledge of Singapore and Malaysia PDPA; preferred: GDPR exposure and third-party risk frameworks.
• Preferred: certifications such as ISO 27001/42001 Lead Auditor/Implementer, CISA, CRISC or CISM, and experience with GRC tools (AuditBoard, DiligentOne, Risk4All, AON CyQu) and cloud platforms (M365, Azure, GWS, GCP).