Assistant Manager - Governance, risk & compliance

Responsibilities

. Serve as the point of contact for governance, risk, and compliance (GRC) matters and stakeholder engagements.

. Facilitate risk and compliance management processes across key stakeholders, including establishing governance structures, processes, and quality assurance reviews of risk assessments, treatment plans, and remediation updates.

. Support management in planning, coordinating, reviewing, and validating internal and external IT reviews to improve efficiency and ensure effective remediation of findings.

. Conduct periodic compliance assessments of applications within the PopHealth Record portfolio to evaluate adherence to applicable policies, standards, and regulatory requirements.

. Perform control assessments and testing to evaluate the design and operating effectiveness of cybersecurity and IT controls, and ensure ongoing compliance with established requirements.

. Identify opportunities to strengthen, streamline, and standardise internal controls and governance practices.

. Develop and enhance management reporting, metrics, and dashboards to provide visibility into the effectiveness of risk, compliance, and control activities.

. Provide timely and actionable risk insights to management, enabling informed decision-making and the implementation of appropriate risk treatment strategies aligned with business objectives.

. Prepare and present regular governance, risk, and compliance reporting to senior management and relevant stakeholders.

. Coordinate and support monthly, quarterly, and ad hoc governance, risk, and compliance forums, committees, and meetings.

. Undertake additional governance, risk, and compliance responsibilities as assigned by management.

Requirements

. Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.

. At least 5 years of relevant experience in one or more of the following areas : Governance, Risk and Compliance (GRC) , Cybersecurity and Information Security , Risk Management , Internal Controls and Audit , Process Improvement , IT Application Development, Operations, or Support

. Strong analytical, critical thinking, problem-solving, organisational, and planning skills.

. Excellent verbal and written communication skills, with the ability to present complex technical and risk-related topics clearly and effectively to both technical and non-technical stakeholders, including senior management.

. Proficient in Microsoft Office applications, including Excel, PowerPoint, Word, SharePoint, and related productivity tools.

. Ability to thrive in a dynamic, fast-paced environment and effectively manage multiple priorities.

. Self-motivated and able to work independently, while also collaborating effectively within cross-functional teams.

. Experience in the healthcare sector, public sector IT, government ICT policies, or the Cybersecurity Code of Practice (CCoP) will be an added advantage.

. Knowledge of industry standards, frameworks, and best practices is advantageous, including : COBIT , SANS Incident Management Framework , PCI DSS , ISO 27001 / Information Security Management Systems (ISMS) , OWASP

. Professional certifications such as CISA, CISSP, CISM, CRISC, CGEIT, or equivalent technology, security, or risk management certifications will be an advantage.

Licence no : 12C6060