Information Security Analyst

Job Overview

The Information Security Analyst is responsible for supporting governance, risk management, and compliance (GRC) functions related to information security, including risks concerning artificial intelligence (AI). This role ensures adherence to regulatory mandates, internal policies, and established governance frameworks.

Key Duties

• Aid in the continuous operation and enhancement of the organisation's information security risk management, control assurance, and compliance activities, using data analytics and AI tools where appropriate.
• Align security practices with international standards such as NIST and ISO, alongside local regulations like TCRMG.
• Deliver accurate risk evaluations, compliance insights, and reports to facilitate effective oversight and decision-making for Information Security leadership and stakeholders.

Location

This position is based at the Head Office in Phnom Penh, Cambodia, with three available roles.

Responsibilities

• Manage and support the bank's information security governance, risk, and compliance, including governance of AI and data-driven technologies, complying with approved policies and frameworks.
• Continuously improve and maintain information security and AI-related GRC processes, ensuring regulatory compliance and conformance to international benchmarks.
• Carry out assigned GRC tasks such as reviews, assessments, and analysis concerning information security and AI controls; assist with documentation, issue tracking, and follow-ups.
• Keep information security and AI governance documentation current, including registers, assessments, policies, standards, and related documents.
• Provide GRC expertise for projects, technological changes, third-party engagements, and AI initiatives, ensuring governance and compliance considerations are incorporated.
• Generate clear, timely, and accurate reporting and analysis to support management oversight and strategic decision-making in information security and AI governance.

Qualifications & Experience

• A Bachelor's or Master's degree in Information Technology, Computer Science, Information Security, or a related technical or risk management field.
• Possession of professional certifications such as CISSP, CISM, ISO27001, CRISC, CGRC, COBIT, or COSO.
• At least five years of professional experience in IT, information security, or related areas, specifically involving governance, risk, and compliance activities.
• Proficient knowledge of information security and risk frameworks and standards like NIST, ISO/IEC 27001/27005, COBIT, COSO, ISACA, and ISC².
• Hands-on involvement with the creation, implementation, or maintenance of information security GRC procedures, including risk assessments, compliance monitoring, and policy management.
• Experience in the development and upkeep of security documentation, including policies, standards, procedures, risk registers, and assessment artifacts.
• Strong analytical capability to evaluate information, identify potential issues, and succinctly communicate findings for reporting and corrective actions.
• Effective communication skills, both oral and written, able to interact constructively with technical and non-technical audiences.
• Demonstrated integrity, professionalism, accountability, and meticulous attention to detail.
• Experience contributing to audits, regulatory examinations, or internal assurance reviews.
• Familiarity or background with AI, data-driven technologies, or governance related to technology risks is considered an advantage.