Governance, Risk & Compliance (GRC) Specialist

Purpose of the Role

Govern the company's ISMS so that it maintains ISO 27001 certification, link information security with GxP requirements (GDP/GMP/GMDP), and control identity and RBAC across the company.

Key Responsibilities

1. Information Security Governance (ISO 27001)

• Manage the ISMS to stay continuously aligned with the standard, not just prepare before audits: develop/review policies, procedures and the Statement of Applicability (SoA).

• Plan and conduct internal audits and management reviews, and track corrective actions to closure.

• Act as the main point of contact for the certification body in surveillance audits and recertification, including the transition to ISO 27001:2022.

• Manage the policy framework (policy / standard / procedure) and document control, aligned with QA's quality documentation system.

2. Risk Management

• Assess information and cyber risk at least once a year and upon significant changes; maintain the risk register and risk treatment plan.

• Perform third-party / vendor risk assessments, including assessment and review of the MSSP, cloud providers and suppliers that access company data or systems.

• Link risk assessment results to business continuity / DR, and produce quarterly security metrics / dashboards for management.

3. Compliance with GxP and Other Regulations

• Work with QA/Regulatory Affairs so that IT controls meet GMP (manufacturing), GDP (distribution) and GMDP requirements, especially for computerized systems, data integrity (ALCOA+), audit trails and electronic records/signatures.

• Support computerized system validation (CSV/CSA) from the security perspective: change control, access control, backup/restore and periodic review.

• Prepare for and answer IT-related questions in inspections by regulators (e.g. the Thai FDA or foreign authorities) and in customer / supplier audits.

• Keep track of relevant laws and standards, such as PDPA and the Cybersecurity Act, and maintain a compliance register.

4. Identity Governance and RBAC

• Own the IAM policy and processes: joiner-mover-leaver, access request/approval and privileged access.

• Design and maintain the RBAC model to match actual job functions, including segregation of duties (SoD) in GxP systems, e.g. producer, reviewer and approver must be separate people.

• Run user access reviews / recertification periodically (e.g. quarterly for GxP and critical systems) and keep evidence for audits.

• Govern the directory (AD/Entra ID), SSO, MFA and PAM together with the infrastructure team and the Senior Cybersecurity Engineer.

• Drive an Identity Governance & Administration (IGA) project over the longer term (if the company decides to procure one).

5. Awareness, Policy and Reporting

• Develop the training plan and company-wide security awareness program (including phishing simulations and targeted courses, e.g. for production floor and warehouse staff).

• Report security and compliance status to senior management and relevant committees.

Qualifications

• Bachelor's degree or higher in IT, Cybersecurity, Engineering or a related field (Pharmaceutical Sciences may be considered with IT/GRC experience).

• At least 5-7 years of experience in GRC / Information Security Governance, with real experience managing ISO 27001 (through surveillance or recertification audits).

• Understanding of GxP requirements for computerized systems and data integrity, or experience in the pharmaceutical / healthcare product / medical device industry.

• Experience in IAM / RBAC / access review in a large organization.

• Able to write clear policies and documents; uses English to read standards and communicate.

Preferred Certifications: ISO 27001 Lead Auditor / Lead Implementer, CISA, CISM, CRISC, CISSP, ISO 27701 or privacy/PDPA certifications, knowledge of CSV/GAMP 5.

Expected Skills and Behaviors

• Translates the language of standards and regulations into practices that production and office teams can actually follow.

• Leadership: able to influence and negotiate with executives and department heads.

• Detail-oriented, systematic, and keeps complete evidence.

• Willing to push back or raise risks with management in a direct manner.