Information Security Governance - Professional

Responsible for managing and supporting Information Security Governance, Risk, and Compliance (GRC) activities to ensure adherence to applicable information security standards, regulatory requirements, internal policies, and client commitments. The role involves implementing and maintaining the Information Security Management System (ISMS), conducting risk assessments, coordinating internal and external audits, monitoring compliance, and driving continuous improvement across information security processes.

Key Roles and Responsibilities

1. ISO 27001:2022 Compliance and ISMS Management

Manage and support the implementation, maintenance, and continual improvement of the Information Security Management System (ISMS) in accordance with ISO/IEC 27001:2022 requirements.

Coordinate internal and external certification and surveillance audits, including audit planning, evidence collection, stakeholder coordination, and closure of audit findings.

Review information security policies, standards, procedures, and control documentation to ensure alignment with ISO 27001:2022 requirements.

Track non-conformities, observations, corrective actions, and continual improvement initiatives.

2. Information Security Risk Assessments

Conduct information security risk assessments to identify, evaluate, and document risks associated with business processes, information assets, systems, and third-party services.

Evaluate risks based on likelihood, impact, existing controls, and residual risk.

Coordinate with risk owners and control owners to define mitigation plans, risk treatment options, and target completion dates.

Monitor risk remediation activities and escalate overdue or high-risk issues to relevant stakeholders.

Maintain risk registers and risk assessment documentation in accordance with the organizations risk management framework.

Support periodic risk reviews and reassessments following significant business, technology, or regulatory changes.

3. SOC 2 Type II Audit Management

Coordinate SOC 2 Type II audit activities, including audit readiness, evidence collection, control validation, and auditor communication.

Work with process owners, IT teams, and other stakeholders to demonstrate the design and operating effectiveness of relevant controls over the audit period.

Map internal controls to applicable Trust Services Criteria, including Security, Availability, Confidentiality, Processing Integrity, and Privacy, where applicable to the audit scope.

Track audit observations, exceptions, and remediation actions through closure.

Maintain audit evidence and supporting documentation to ensure traceability and readiness for external assessments.

Facilitate periodic control reviews and support continuous compliance monitoring.

4. Media Disposal and Information Asset Security

Govern the secure disposal and sanitization of information-bearing media, including laptops, desktops, storage devices, and other IT assets.

Ensure media disposal practices align with organizational policies, contractual commitments, and applicable security standards.

Review and maintain media sanitization records, data erasure certificates, destruction evidence, and disposal approvals.

5. NIST Cybersecurity Framework 2.0

Facilitate NIST Cyber Security Framework(CSF) 2.0 assessments to evaluate the organizations maturity and alignment with applicable framework requirements.

Documents assessment results, maintain gap assessment trackers, and monitor corrective actions to strengthen cybersecurity governance and compliance.

6. MSA Review

Conduct MSA review to evaluate compliance with defined management system requirements, information security policies, standards and controls.

7. Third-Party Risk Management

Support information security risk assessments for vendors, suppliers, and service providers.

Review third-party security documentation, audit reports, certifications, and control evidence, as applicable.

Assess vendor compliance with contractual security requirements, confidentiality obligations, incident reporting timelines, and data protection commitments.

8. Security Incident Governance and Compliance Monitoring

Support governance oversight of information security incident management processes.

Review incident management procedures for alignment with organizational policies, contractual obligations, and applicable compliance requirements.

Coordinate with relevant teams to track incident-related corrective actions and compliance gaps.

9. Audit Readiness, Evidence Management, and Corrective Actions

Maintain organized and traceable audit evidence repositories for internal, external, certification, and client audits.

Coordinate with control owners to obtain accurate, complete, and timely audit evidence.

Validate evidence against control requirements and identify documentation gaps or control exceptions.

Maintain audit issue trackers, corrective action plans, and compliance status reports.

Follow up with stakeholders to ensure timely closure of audit findings and risk remediation activities.

Drive continuous improvement in audit readiness and compliance processes.

10. Stakeholder Management and Awareness

Collaborate with internal stakeholders, auditors, risk owners, control owners, and business teams to implement security governance requirements.

Communicate compliance obligations, audit expectations, and remediation requirements to relevant stakeholders.

Support information security awareness and compliance initiatives.

Facilitate governance meetings, compliance reviews, and action-tracking discussions.

Prepare periodic status reports highlighting key risks, audit findings, compliance gaps, and remediation progress.

## Skills and Competencies

Strong understanding of ISO/IEC 27001:2022 and ISMS requirements.

Experience in information security risk assessment and risk treatment.

Knowledge of SOC 2 Type II audits and Trust Services Criteria.

Knowledge of secure media sanitization, data destruction, and IT asset disposal processes.

Familiarity with information security policies, control frameworks, audit methodologies, and compliance management.

Strong analytical, documentation, stakeholder management, and communication skills.

Ability to manage multiple audits, assessments, and compliance activities simultaneously.

Experience with GRC tools, risk registers, audit evidence repositories, and compliance tracking platforms.

## Overall Objective

To strengthen the organizations information security governance and compliance posture by ensuring effective implementation of security controls, proactive risk management, audit readiness, secure information lifecycle management, and adherence to applicable contractual, regulatory, and industry-standard requirements.