Job Description

Job Summary: The Information and Security Compliance Manager is responsible for developing, implementing, and monitoring the organization's information security policies, standards, and compliance frameworks. This role ensures the business adheres to applicable regulatory requirements (e.g., GDPR, HIPAA, ISO 27001, NIST, PCI-DSS) and internal security policies, while also supporting risk assessments, audits, and third-party vendor evaluations.

The role bridges IT, security, and business units to maintain a secure and compliant operating environment.

Key Responsibilities:

Governance & Compliance
• Develop and maintain the organization’s information security and compliance frameworks.
• Interpret and apply regulatory, legal, and contractual requirements to security and IT operations.
• Ensure compliance with standards such as ISO 27001, NIST CSF, PCI-DSS, GDPR, or industry-specific frameworks.

Audit & Risk Management
• Lead internal and external audits (e.g., ISO, regulatory, client).
• Conduct regular compliance assessments, gap analyses, and control testing.
• Maintain a risk register and coordinate remediation of identified risks or control deficiencies.

Policy & Awareness
• Develop and enforce information security policies, procedures, and guidelines.
• Conduct awareness programs and training to promote a culture of security and compliance.

Incident & Vendor Management
• Collaborate with IT teams to ensure appropriate incident response procedures are in place and tested.
• Evaluate third-party vendors for compliance and data protection practices.
• Support due diligence and contractual reviews regarding data handling and cybersecurity controls.

Reporting & Metrics
• Prepare compliance reports and dashboards for senior leadership and regulators.
• Track and report on key risk and compliance indicators (KRCIs).

Skills Required

• Analytical Thinking
• Project Management