Proposed Reporting & Stakeholders

• Department: IT / Information Security / Governance
• Reports to: CEO, CIO, CTO, or Head of IT, subject to approved organization structure
• Stakeholders: Top Management, Development, IT Security, Cloud Operations, Operations, HR, Legal,
• Compliance, Group DPO, Internal Audit, clients, auditors, QSA, and service providers

Job Description

Job Purpose

• Lead IT governance, security compliance, and data protection engineering across the company’s contact center services and supporting technology environment.
• Coordinate ISO/IEC 27001, SOC 2, applicable PCI DSS requirements, and technical privacy controls, including cross-border data transfer assessments.
• Translate regulatory, contractual, and security requirements into practical, measurable, and auditable controls with technology, business, DPO, Legal, and Compliance teams.

Key Responsibilities

IT Governance, Risk & Compliance

• Develop and maintain IT GRC policies, risk registers, control matrices, compliance obligations, and remediation tracking.
• Coordinate risk assessments, control ownership, policy approval, change management, and compliance monitoring across functions.
• Report material risks, control gaps, overdue actions, and improvement priorities to management.

ISO/IEC 27001 and ISMS

• Coordinate ISMS maintenance, risk treatment, Statement of Applicability (SoA), objectives, and continual improvement.
• Coordinate audit readiness, management review inputs, nonconformity handling, and corrective-action follow-up.
• Act as ISMS Coordinator / Management Representative only when formally appointed by top management.

SOC 2 and PCI DSS

• Coordinate SOC 2 scope, Trust Services Criteria mapping, system description, evidence readiness, auditor requests, and remediation tracking.
• Coordinate PCI DSS applicability and scope validation, payment-data-flow review, requirement mapping, and QSA engagement where applicable.
• Track shared responsibilities and control gaps across the company, clients, payment providers, and service providers.

Data Protection Engineering (DPE) and Cross-Border Transfers

• Translate data-protection requirements into technical controls for data flows, access, encryption, masking, retention, deletion, and audit logging.
• Provide technical input to DPIAs, ROPA, privacy-by-design reviews, and Transfer Impact Assessments (TIAs).
• Coordinate with the group DPO, Legal, Compliance, clients, and data owners on legal assessment, transfer safeguards, decisions, and reassessment.

Technical Security Governance and Reporting

• Review security requirements for applications, APIs, databases, telephony, recording, cloud, Docker environments, and third-party integrations.
• Monitor control implementation and remediation with IT Security, Development, and Cloud Operations without taking over their operational ownership.
• Maintain compliance dashboards, evidence registers, KPI reporting, and management escalations.

Qualifications & Competencies

• Bachelor’s degree in IT, Computer Science, Cybersecurity, or related field, or equivalent experience; typically 6–10 years in relevant IT security, GRC, audit, or architecture roles. – Required (High)
• Practical knowledge of ISO/IEC 27001, SOC 2, PCI DSS, Indonesian data-protection requirements, and privacy-by-design; direct implementation experience preferred. – Required (High)
• Working knowledge of application/API/database architecture, telephony and recording, cloud/network security, Docker/OS controls, IAM, logging/SIEM, and software delivery. – Preferred

Preferred Certifications

• ISO/IEC 27001 Lead Implementer or Lead Auditor.
• CISA, CRISC, CISSP, or equivalent relevant security/GRC certification.
• PCI DSS-related training and relevant privacy/data-protection certification.