GRC Analyst / Consultant

About This Role

You will be at the front line of Cloudsphere's GRC practice, walking clients from gap analysis all the way through certification audit. The role combines deep standards knowledge with the ability to translate controls into practices client teams actually follow day to day.

What You Will Do

• Run gap analyses and risk assessments against ISO/IEC 27001:2022, NIST CSF, and Indonesia's PDP Law.
• Produce ISMS documentation: policies, procedures, the Statement of Applicability, and risk registers.
• Facilitate workshops and security awareness training with client stakeholders.
• Conduct internal audits and support clients through Stage 1 and Stage 2 certification audits.
• Track finding closure and report compliance progress to client management.

What We Are Looking For

• At least 2 years in GRC, compliance, IT audit, or risk management.
• Deep working knowledge of ISO/IEC 27001:2022 and its 93 Annex A controls.
• Ability to write clean, precise policy documents and audit reports.
• Strong communication in both Indonesian and English, written and spoken.
• Comfortable working directly with clients across very different maturity levels.