Job Description
Job Summary
The company is seeking a GRC Engineer to build and formalize its Governance, Risk, and Compliance. This role will be responsible for designing security policies, managing risk assessments, driving compliance initiatives (ISO 27001, SOC 2 Type II), and strengthening privacy and physical security processes. The engineer will work closely with technical and business teams to ensure security requirements are embedded across all operations.
Key Responsibilities
Risk Assessment & Management
- Lead periodic information security risk assessments across systems, infrastructure, and business processes.
- Maintain the company’s risk register and ensure timely remediation and risk treatment planning.
- Collaborate with engineering, product, and business units to ensure risks are understood, prioritized, and addressed.
- Develop metrics and dashboards for continuous monitoring of security risks.
Security Awareness & Training
- Evaluate training effectiveness and recommend improvements to strengthen security culture.
- Work with HR to integrate security training into onboarding and staff development.
- Design and deliver security awareness programs, including phishing simulations, annual training, and role- based education.
Security Policy & Procedure Development
- Ensure policies align with industry frameworks (NIST, ISO 27001) and regulatory requirements.
- Develop, maintain, and improve security policies, standards, and procedures across all departments.
- Support the rollout and enforcement of policies across teams and business units.
Physical Security
- Develop physical security guidelines and coordinate periodic audits.
- Conduct risk assessments related to access control, surveillance, and asset protection.
- Collaborate with facilities and operations teams to assess physical security across stores, warehouses, and offices.
Data Protection & Privacy
- Assist in identifying and managing personal data risks, data flows, and data handling procedures.
- Collaborate with legal and IT teams to support compliance with privacy regulations.
- Support the implementation and operation of data protection and privacy programs.
- Participate in incident management related to data breaches and privacy risks.
Certification & Compliance (ISO 27001, SOC 2 Type II)
- Contribute to the preparation, implementation, and maintenance of certification projects (e.g., ISO 27001, SOC 2 Type II).
Job Requirements
- 1–3+ years of experience in governance, risk management, compliance, or cybersecurity.
- Ability to write clear policies and communicate security concepts to both technical and non- technical audiences.
- Good analytical, documentation, and project management skills.
- Experience with ISO 27001, SOC 2, or similar compliance programs.
- Organized, detail- oriented working style with a proactive attitude.
- Strong understanding of information security fundamentals, risk assessment methodologies, and compliance frameworks.
Nice- to- have:
- English communication.
- Familiarity with business continuity planning, vendor risk management, or audit processes.
- Relevant certifications: ISO 27001 Lead Implementer/Lead Auditor, CRISC, CISA, Security+, or equivalent.
- Experience in privacy programs (GDPR, local privacy laws).
Benefit
- Regular training, company team building, birthday bonus
- Fast promotion opportunities based on personal ability
- Work in a dynamic, open, creative environment
- Annual bonus: 2- 3 months under minimum KPI requirement
About Concung.com
- Working time: 8:30- 17:30 Monday- Friday
- Working place: 5th Floor, Con Cưng Super Center, 09 Nguyen Trai Street, Ben Thanh Ward, Dist. 1, HCMC
