IT GRC Specialist – Privacy Operations

We are looking for an experienced IT GRC Specialist – Privacy Operations to strengthen our governance, risk, and compliance capabilities, with a strong focus on privacy operations and Indonesian Personal Data Protection (PDP) compliance.
In this role, you will play a key part in ensuring that our organization maintains strong regulatory readiness while enabling business growth through secure and compliant practices. This is a hands-on, execution-focused role where you will collaborate across multiple functions including Engineering, Product, Legal, Risk, and Compliance.
Responsibilities
Develop and improve IT GRC frameworks, policies, SOPs, and control processes across:
Information Security & Privacy Operations
Incident Management & Access Governance
Audit Remediation & Third-Party Risk
Drive day-to-day privacy operations, including:
Data inventory & records management
Privacy control monitoring & issue tracking
Coordination of privacy assessments
Ensure compliance readiness with:
ISO 27001, PCI DSS, SOC 2, NIST
Indonesian Personal Data Protection (PDP) Law
Partner with cross-functional teams (Engineering, Product, Legal, Audit, Risk) to:
Implement corrective actions
Support privacy-by-design and security-by-default initiatives
Strengthen governance and compliance practices
Manage audit activities including:
Evidence preparation & documentation
Remediation tracking
Regulatory reporting support
Support and improve governance and privacy tooling used for:
Workflow tracking
Evidence management
Compliance monitoring
Requirements
Education
Bachelor’s degree in Information Technology, Computer Science, Information Systems, Cybersecurity, Law, Business Administration, or a related field.
Experience
5–10 years of experience in IT GRC, Security Compliance, Privacy Governance, IT Audit, Risk Management, or related areas.
Hands-on experience implementing Personal Data Protection (PDP) programs and privacy frameworks such as ISO 27701.
Experience managing privacy processes, including:
RoPA (Records of Processing Activities) / data inventory
DPIA / PIA assessments
Privacy notices and consent management
Data retention controls
Data Subject Rights (DSR) requests
Familiar with privacy management tools for assessments, workflow management, reporting, and compliance tracking.
Experience in fintech, banking, technology, e-commerce, or other regulated industries is a plus.
Technical Skills
Strong knowledge of Governance, Risk & Compliance (GRC) principles, including risk assessment, control testing, audits, remediation tracking, and policy management.
Good understanding of privacy regulations, personal data protection, and data lifecycle management.
Familiar with industry standards and frameworks such as ISO 27001, ISO 27701, PCI DSS, NIST, and COBIT.
Understanding of third-party/vendor risk management and data processing governance.
Soft Skills
Strong analytical and problem-solving skills.
Excellent communication skills in both English and Bahasa Indonesia.
Able to work effectively with regulators, auditors, management, business teams, and technical stakeholders.
Strong stakeholder management and project coordination skills.
Detail-oriented with strong documentation abilities.
Preferred Certifications
ISO 27001 and/or ISO 27701 Lead Implementer or Lead Auditor.
Privacy certifications such as CIPM, CIPP, CDPO, or equivalent.
Risk, audit, or compliance certifications are an advantage.