IT GRC
About the role
We are seeking an IT GRC Specialist (Senior Officer Level) to run the company's Information Security Management System (ISMS) and information technology compliance on a daily basis, covering ISO/IEC 27001:2022, PCI DSS 4.0.1, Bank Indonesia regulations for payment system operators (including PBI 2/2024 on Information System Security and Cyber Resilience), and Law No. 27 of 2022 on Personal Data Protection. This position reports to the Head of IT Security.
Key responsibilities
Maintain the Company's ISMS: risk register, Statement of Applicability (SoA), risk treatment plans, internal audits, and management reviews.
Execute the policy framework lifecycle (POL, STD, PRO) — review, approval, and version control — and develop planned policy documents, starting with Logging & Monitoring, BCP/DR, and Personnel Screening.
Coordinate ISO 27001 audits and PCI DSS assessments with Qualified Security Assessors (QSA): evidence collection, finding tracking, and compensating control documentation.
Maintain regulatory obligations register and reporting to Bank Indonesia, including incident notification processes (initial notification 1 hour, full report 3 days), and — together with the Legal function — personal data breach notifications in accordance with the Personal Data Protection Law.
Execute third-party security risk management in accordance with procedure PRO-06: vendor due diligence, contract clauses, and annual reviews.
Coordinate Business Continuity Plan (BCP) and Disaster Recovery (DR) testing, and monitor achievement of recovery time objectives (RTO) and recovery point objectives (RPO).
Execute security awareness program for employees and monitor completion rates.
Report compliance status and key risk indicators to the Head of IT Security monthly.
About you
Bachelor's degree (S1) in Information Systems, Computer Science, or related field.
4–7 years of experience in IT GRC, IT risk, IT audit, or security compliance, with at least 2 years at a company regulated by Bank Indonesia or the Financial Services Authority (payment system operators, banks, electronic money, or fintech).
Hands-on experience implementing ISO/IEC 27001:2022, including risk assessment, Statement of Applicability development, and internal audits.
Experience supporting PCI DSS v4.x assessments with a Qualified Security Assessor (QSA).
Understanding of Bank Indonesia regulations for payment system operators and Law No. 27 of 2022 on Personal Data Protection.
Ability to write policies and reports clearly and in a structured manner, in both Indonesian and English.
Integrity and discretion. This role has access to sensitive incident details and audit results.
Assertive yet professional. Able to persistently follow up on deadlines with senior control owners without damaging working relationships.
Structured and precise writing. Policies and reports produced are clear, unambiguous, and easily auditable.
About us
Faspay, operated by PT Media Indonusa, is a payment gateway service provider serving thousands of merchants and connected with major banks in Indonesia. Our business activities are entirely based on the trust that funds and data entrusted to us are safeguarded and governed adequately.