IT Security Governance

About the roleIT Security Governance role supporting the IT Security Team Lead in planning, maintaining and tracking the IT Security Roadmap aligned with recognized frameworks (NIST CSF, ISO/IEC 27001) and business objectives. The role encompasses security governance, policy management, risk assessment, compliance, audit coordination, process controls, security awareness programs, data security initiatives, and stakeholder coordination across the organization.Key responsibilitiesSupport the IT Security Team Lead in planning, maintaining and tracking the IT Security Roadmap, aligned with recognized frameworks (NIST CSF, ISO/IEC 27001) and business objectivesEstablish, review and update IT Security Policies, Regulations, Standards and Procedures; identify security domain gaps against NIST / ISO 27001; and drive policy announcement and acknowledgement across companiesCoordinate IT security risk assessments (including updating the risk assessment questionnaire to the latest ISO 27001), third-party and dealer security assessments, and follow up risk acceptance and remediation plans until closureAct as the focal point for internal and external IT security audits; prepare evidence and follow up audit findings with responsible teams until fully closedEstablish and operate IT security process controls and quality checks to verify that approved IT Security Regulations and controls are implemented correctly and remain effectivePlan and execute the annual security awareness program, including e-IT Security learning, phishing simulations (3 times/year), table-top exercises (e.g., PDPA, incident response), awareness for the IT team, and dealer/branch securityDevelop awareness materials, the monthly IT Security Newsletter and threat news; deliver training and provide ad-hoc consultation on IT Security Regulations to staff and companiesSupport data protection initiatives such as Google DLP implementation, data classification and PDPA-related controlsCollaborate with system owners, Infra/App Security teams, business units, dealers and external consultants to resolve issues and implement permanent solutions to prevent recurring problemsDefine and monitor KPIs (e.g., phishing click rate, training completion, policy compliance, audit findings closure) and report status to the IT Security Team Lead and management in a timely mannerAbout youKnowledge of IT security governance frameworks and standards (e.g., ISO/IEC 27001, NIST CSF) and Thai PDPAExperience in drafting and reviewing IT security policies, regulations, standards and proceduresUnderstanding of IT risk assessment, IT security controls and the IT audit process (evidence preparation, findings follow-up)Knowledge of security awareness practices such as phishing simulation, social engineering, e-learning and table-top exercisesKnowledge of data security / data protection (e.g., DLP, data classification)Basic understanding of infrastructure and application security (network, cloud, endpoint, web application) to communicate with technical teamsSecurity certifications ISC2 CC or CompTIA Security+ as minimumStrong communication and presentation skills; able to explain security to non-technical audiencesGood collaboration and stakeholder management across business units, IT teams and dealersDetail-oriented, systematic and well-organized