GRC Analyst - Governance | Risk and Compliance Analyst (Information Security Department)
IT - Software / DB / QA / Web / Graphics / GIS
About the Employer
Job Description
GRC Analyst
(Governance, Risk, and Compliance Analyst) Information Security Department
Job Responsibilities
- Maintain the Information Security Management System (ISMS) documentation, including policies, standards, procedures, control libraries, and evidence repositories
- Coordinate the policy lifecycle, manage risk-based justifications and time-bound plans
- Support enterprise security risk assessments and Risk and Control Self Assessments (RCSAs) by facilitating workshops, identifying control gaps, and tracking mitigation plans to closure
- Maintain the Information Security Risk Register and Control Ownership Matrix to ensure accurate tracking
- Assist with ISMS, BCMS, AIMS, PDPA, and ITSM operations, control performance monitoring, corrective/preventive action tracking, and certification support
- Coordinate compliance monitoring against CBSL technology risk expectations and prepare evidence / responses for regulatory engagements
- Support PCI DSS and SWIFT CSP compliance activities with relevant system and process owners
- Prepare evidence packs for internal/external audits, respond to audit queries, and track audit findings and management action plans
- Support third-party security due diligence by managing questionnaires, reviewing evidence and tracking issues with procurement and vendors
- Support the periodic review of asset inventories, data classification activities, and control alignment based on asset criticality and data sensitivity
- Support Information Security Committee ISSC activities by preparing materials, action trackers, and follow-ups
Experience & Qualifications
- Strong knowledge of ISO/IEC 27001, 27002, 27701, 20001, and 42001 controls and integrated management system operations
- Familiarity with NIST CSF and related control frameworks
- Understanding of CBSL technology risk expectations and practical compliance within a Sri Lankan banking context
- Awareness of Sri Lankan Personal Data Protection Act (PDPA) obligations, PCI DSS, and SWIFT CSP requirements
- Hands-on experience in supporting risk assessments, RCSAs, control testing, and remediation tracking
- Strong coordination and stakeholder management skills across Technology, Risk, Compliance, Internal Audit, and external vendors
Interested candidates are invited to forward their CVs to [email protected] mentioning the post applied for in the subject line of the email on or before 2nd November 2026.
Head of Human Resources
Cargills Bank PLC, No. 696, Galle Road, Colombo 03. Tel. 011 7 640 640
