Department

Information Technology / Information Security

Reporting To

Head of IT / Manager-IT

Role Purpose

The Information Security & ISO 27001 Compliance Administrator is responsible for owning, maintaining, and continuously improving the organization’s Information Security Management System (ISMS) in alignment with ISO/IEC 27001:2022.
This role ensures compliance, audit readiness, and effective governance across IT and business operations without directly owning day‑to‑day IT infrastructure implementation.

Key Responsibilities

ISO 27001 & ISMS Management

• Own and maintain the ISMS framework in line with ISO/IEC 27001:2022
• Maintain:
  • Risk register and risk treatment plans
  • Statement of Applicability (SoA)
  • ISMS policies, procedures, and standards
• Coordinate and support internal and external audits
• Track audit observations, non‑conformities, and corrective actions to closure

Compliance Monitoring & Evidence Management

• Continuously collect and maintain ISO evidence including:
  • Access reviews
  • Backup verification
  • Patch compliance
  • Logging and monitoring records
• Ensure evidence is:
  • Complete
  • Timely
  • Audit‑ready
• Periodically review control effectiveness and report findings

Governance & Risk Coordination

• Conduct periodic risk assessments with IT and business stakeholders
• Monitor compliance with security policies and procedures
• Escalate compliance gaps, risks, and control failures
• Support supplier security assessments and third‑party risk reviews
• Support customer security assessments and third‑party risk reviews
• Review latest CVE / vulnerabilities and analyze how it affect IT-infrastructure