Governance & Policy Analyst

Responsibilities:

Governance & Policy:

• Assist in drafting, reviewing, and maintaining information security policies, standards, procedures, and guidelines.
• Map policies and controls against recognised frameworks (ISO/IEC 27001, PCI DSS) and flag gaps.
• Maintain documentation of security governance structures, roles, and responsibilities.

Risk Management:

• Support enterprise information security risk assessments and the development of risk treatment plans.
• Maintain the security risk register and follow up with control owners on remediation status.
• Prepare risk documentation to help business units evaluate mitigation, acceptance, transfer, or avoidance.

Compliance & Regulatory Assurance:

• Support compliance activities across applicable laws, regulations, and contractual requirements (NDPR, PCI DSS, ISO 27001).
• Coordinate evidence collection and logistics for internal and external audits, assessments, and certifications.
• Track audit findings and compliance gaps to closure.

Metrics & Reporting:

• Maintain security governance KPIs, KRIs, and dashboards.
• Compile security posture reports for management, risk committees, and auditors.
• Provide inputs into executive and board-level reporting.

Third-Party & Vendor Security:

• Support third-party security risk assessments and due diligence reviews.
• Review supplier security questionnaires and assist in assessing contractual security clauses.
• Monitor ongoing compliance of critical vendors and escalate exceptions.

Awareness & Continuous Improvement:

• Support delivery of security awareness and policy training initiatives.
• Monitor regulatory changes and emerging governance trends, and summarise impact.
• Contribute to improving governance processes and control maturity.

Requirements:

• Bachelor’s degree in information security, computer science, information technology, or a related field.
• Minimum of 3 years’ experience in information security governance, risk, and compliance (GRC), or in IT audit / internal control with GRC exposure.
• Working knowledge of at least one recognised framework (ISO 27001, NDPR, PCI DSS).
• Understanding of risk management methodologies and control frameworks.
• Exposure to audits, compliance reviews, or regulatory assessments.
• Strong documentation, analytical, and stakeholder communication skills.
• Reliable internet connection and a suitable home work setup for remote delivery.

Added Advantage:

• Familiarity with GRC tools or platforms.
• Progress toward a relevant certification (ISO 27001 LI/LA, CISA, CRISC, Security+).
• Experience in financial services, fintech, or telecommunications.