Information Security GRC Coordinator

About the role

The Information Security GRC Coordinator supports the day-to-day execution of Information Security Governance, Risk and Compliance activities across the Group. The role covers administrative, coordination, tracking, reporting and documentation work that enables the Information Security GRC function to operate effectively. It works closely with Information Security, Technology, Risk Management, Compliance, Internal Audit and business stakeholders, and is a junior role offering practical exposure to cybersecurity governance, risk management, compliance, audit and control assurance.

Key responsibilities

• Governance administration: maintain policies, standards, procedures and governance documentation; track policy reviews and approvals; record governance committee minutes and follow up on action items.
• Cyber risk management: maintain the risk register, record new risks, treatments, acceptances and exceptions, follow up overdue remediation, gather information for risk assessments and prepare risk reports and dashboards.
• Internal control system coordination: maintain inventories of processes, risks, controls and control owners, coordinate periodic reviews, obtain evidence, track review schedules and support management reporting on control status.
• Compliance and regulatory support: assist with compliance assessments, maintain compliance obligation registers, track regulatory findings and audit observations, and prepare documentation for audits.
• Audit coordination: schedule internal and external audits, collect evidence, maintain issue and finding registers and follow up on closure of findings.
• Reporting and metrics: compile GRC dashboards, metrics, KRIs and KPIs, prepare weekly and monthly reports and management presentations.
• Third-party risk: coordinate vendor security questionnaires, supplier due diligence and remediation follow-up.
• Security awareness: coordinate awareness campaigns, track mandatory training completion, support phishing simulations and awareness events.
• Stakeholder coordination: act as a central coordination point for GRC activities and group-wide security initiatives.

Required profile

• Bachelor's degree in Information Security, Computer Science, Information Technology, Risk Management, Business Administration or a related field.
• 1-3 years of experience in Information Security, IT Risk, Compliance, Audit, IT Operations, Governance or related disciplines.
• Experience maintaining documentation, reports, registers or compliance records.
• Exposure to regulated environments is beneficial but not required; recent graduates with relevant internships may be considered.
• Professional certifications are desirable but not mandatory (e.g., Security+, ISO 27001 Foundation, COBIT, ITIL, CC, CRISC, CISA).