Assistant Manager - Governance, risk & compliance (Ref 26272)

Responsibilities

• Serve as the point of contact for governance, risk, and compliance (GRC) matters and stakeholder engagements.

• Facilitate risk and compliance management processes across key stakeholders, including establishing governance structures, processes, and quality assurance reviews of risk assessments, treatment plans, and remediation updates.

• Support management in planning, coordinating, reviewing, and validating internal and external IT reviews to improve efficiency and ensure effective remediation of findings.

• Conduct periodic compliance assessments of applications within the PopHealth Record portfolio to evaluate adherence to applicable policies, standards, and regulatory requirements.

• Perform control assessments and testing to evaluate the design and operating effectiveness of cybersecurity and IT controls, and ensure ongoing compliance with established requirements.

• Identify opportunities to strengthen, streamline, and standardise internal controls and governance practices.

• Develop and enhance management reporting, metrics, and dashboards to provide visibility into the effectiveness of risk, compliance, and control activities.

• Provide timely and actionable risk insights to management, enabling informed decision-making and the implementation of appropriate risk treatment strategies aligned with business objectives.

• Prepare and present regular governance, risk, and compliance reporting to senior management and relevant stakeholders.

• Coordinate and support monthly, quarterly, and ad hoc governance, risk, and compliance forums, committees, and meetings.

• Undertake additional governance, risk, and compliance responsibilities as assigned by management.

Requirements

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related discipline.

• At least 5 years of relevant experience in one or more of the following areas : Governance, Risk and Compliance (GRC) , Cybersecurity and Information Security , Risk Management , Internal Controls and Audit , Process Improvement , IT Application Development, Operations, or Support

• Strong analytical, critical thinking, problem-solving, organisational, and planning skills.

• Excellent verbal and written communication skills, with the ability to present complex technical and risk-related topics clearly and effectively to both technical and non-technical stakeholders, including senior management.

• Proficient in Microsoft Office applications, including Excel, PowerPoint, Word, SharePoint, and related productivity tools.

• Ability to thrive in a dynamic, fast-paced environment and effectively manage multiple priorities.

• Self-motivated and able to work independently, while also collaborating effectively within cross-functional teams.

• Experience in the healthcare sector, public sector IT, government ICT policies, or the Cybersecurity Code of Practice (CCoP) will be an added advantage.

• Knowledge of industry standards, frameworks, and best practices is advantageous, including : COBIT , SANS Incident Management Framework , PCI DSS , ISO 27001 / Information Security Management Systems (ISMS) , OWASP

• Professional certifications such as CISA, CISSP, CISM, CRISC, CGEIT, or equivalent technology, security, or risk management certifications will be an advantage.

Licence no : 12C6060