About the Role
We are looking for an experienced Senior Manager, Governance, Risk & Compliance (GRC) to lead and strengthen governance, risk, compliance and assurance activities across the organisation.
The role works closely with senior leadership and cross-functional teams including IT, Digital, Operations, Human Resources, Finance and Sales to translate regulatory, contractual, certification, security and risk requirements into practical and proportionate business controls.
The successful candidate will play an important role in strengthening organisational resilience, compliance maturity, audit readiness, responsible technology adoption and overall risk governance.
Key Responsibilities
GRC Leadership & Advisory
- Lead and continuously improve GRC frameworks, priorities and governance practices.
- Advise leadership and business stakeholders on information security risk, enterprise risk, corporate governance, ESG, compliance and audit readiness.
- Develop and maintain governance frameworks, policies, procedures, risk methodologies and reporting mechanisms.
- Monitor emerging regulatory, technology and operational risks and recommend appropriate actions.
- Prepare and present GRC performance, key risks, audit status and certification readiness to management.
Certification, Audit & Compliance
- Lead maintenance and continual improvement activities relating to ISO 27001, ISO 22301, ISO 9001, ISO 18295-1, ISO 42001, SOC 2 Type 2 and PCI DSS.
- Coordinate internal, external, certification and client audits.
- Manage audit findings, non-conformities, control gaps and corrective actions through to closure.
- Maintain governance documentation, policies, SOPs, risk registers, control records and audit evidence.
Enterprise Risk Management
- Oversee enterprise, information security, operational, technology, third-party and business continuity risk activities.
- Develop and maintain risk assessment methodologies, risk registers and treatment plans.
- Facilitate risk assessments with business and technology stakeholders.
- Review risk acceptance requests, policy exceptions and compensating controls.
- Support the integration of risk management into new systems, projects, AI initiatives and technology adoption.
AI Governance & ISO/IEC 42001
- Establish governance requirements for the responsible development, deployment and use of AI systems.
- Drive AI Management System (AIMS) governance, including AI policies, inventories, risk assessments, impact assessments and performance measurements.
- Work with Digital, IT, Operations and AI system owners to identify AI-related risks and establish appropriate controls.
- Support alignment with ISO/IEC 42001, privacy requirements and responsible AI principles.
Business Continuity & Operational Resilience
- Oversee the governance and continual improvement of the Business Continuity Management System.
- Review business impact analysis, continuity plans, recovery strategies and crisis-management arrangements.
- Coordinate business continuity exercises and recovery testing.
- Provide governance oversight for information security, technology, privacy, operational and compliance-related incidents.
Corporate Governance, ESG & Privacy
- Support corporate governance, internal control and enterprise risk reporting requirements.
- Support relevant annual-report governance and risk disclosures.
- Lead and coordinate ESG and sustainability governance activities.
- Support alignment with applicable Bursa Malaysia sustainability and reporting requirements.
- Provide governance and risk input on privacy, data protection, regulatory and contractual matters.
Client Assurance & Business Enablement
- Support tenders, RFPs, due diligence and client assurance activities from a GRC perspective.
- Participate in client meetings, audits, assessments and presentations.
- Review client requirements and identify potential security, compliance, privacy, contractual and operational risks.
- Work with relevant stakeholders to develop practical and risk-informed solutions.
Team & Stakeholder Management
- Lead, coach and develop GRC team members.
- Set priorities, quality expectations, delivery timelines and accountability.
- Review risk assessments, policies, reports, audit evidence and other GRC deliverables.
- Build strong relationships with leadership, internal teams, auditors, certification bodies, clients and service providers.
- Promote a culture of accountability, risk awareness, security, resilience and continuous improvement.
Requirements
- Bachelor's Degree in Information Security, Information Technology, Computer Science, Risk Management or a related field.
- 8–12 years of relevant experience in areas such as GRC, Information Security Governance, Enterprise/Technology Risk, Audit & Compliance, Business Continuity, Privacy, ESG or AI Governance.
- Proven experience in a managerial or senior managerial capacity within GRC, risk, compliance, information security governance or assurance.
- Experience managing and developing team members.
- Strong experience coordinating internal, external, certification and/or client audits.
- Experience with management-system documentation, policies, risk registers, control evidence and audit findings.
- Strong stakeholder management skills with the ability to engage senior leadership, auditors, clients and cross-functional teams.
- Strong analytical, problem-solving and decision-making capabilities.
- Ability to translate complex governance, security, risk and compliance requirements into practical business actions.
- Practical, business-oriented and solution-focused mindset.
Preferred Qualifications
Relevant professional certifications will be an added advantage, including:
- CISSP – Certified Information Systems Security Professional
- CISM – Certified Information Security Manager
- Other relevant certifications in governance, risk, privacy, business continuity, sustainability, audit or compliance.
If you are an experienced GRC professional ready to take on a Senior Manager-level role with broad exposure across risk, compliance, information security, AI governance and organisational resilience, we would like to hear from you.
