Key Responsibilities

Run our ISO/IEC 27001:2022 and PCI DSS v4.0.1 programmes from start to finish: scoping, evidence, control testing, gap closure and audit sign-off, reporting to the IT Manager.
Act as the main contact for auditors, QSAs and client security teams: agree scope and evidence requests, lead walkthroughs and see every finding through to closure.
Test controls on the actual systems rather than taking a policy’s word for it, and make the call on whether each control passes, partly passes or fails.
Keep the compliance record ready for audit at any time: ISMS documents, risk register, Statement of Applicability, evidence library and gap tracker.
Work with Engineering and Operations to turn findings into fixes with named owners and dates, and tell the IT Manager early when something will miss a deadline.
Run the office infrastructure records that audits rely on: IT asset and laptop tracking, infrastructure documentation approvals, PRFs and other internal forms.

Compliance Programme Ownership

Run the ISO/IEC 27001:2022 cycle: the ISMS document set against Clauses 4 to 10 and the Annex A controls, the Statement of Applicability, the risk treatment plan, the internal audit programme, management review inputs, and nonconformity and corrective action records.
Run the PCI DSS v4.0.1 cycle: scoping and cardholder data environment boundaries, requirement-by-requirement evidence, quarterly ASV scans, annual penetration testing, segmentation testing, targeted risk analyses and the split of responsibility with service providers.
Plan and lead audit readiness: a rolling evidence calendar, audit packs, and dry runs with control owners before the assessor arrives.
Assess the compliance impact of change before it goes live, whether a new system, client, architecture or supplier, and keep scope, data flow and network diagrams current.
Support client-driven assurance beyond our certified scope: SOC 2 or equivalent attestations, control narratives and bespoke client audits, including scoping and readiness if we take one on.

Control Testing and Assurance

Sample and test controls across access, change management, logging and monitoring, patching, anti-malware, file integrity monitoring, backup, encryption, physical security and vendors.
Run the periodic access reviews across servers, databases, cloud consoles and applications, including joiner, mover and leaver checks, and chase the exceptions to closure.
Check that log review, alert follow-up and file integrity monitoring happen as the procedures say, and keep the evidence as it is produced.
Verify hardening baselines on Linux servers, cloud services and applications. Confirm each vulnerability scan and penetration test fix is real before the finding is closed.
Compare backup, restore and DR test results with what the plans promise, and record plainly where they fall short.
Where a finding cannot be fixed within the assessment window, document the remediation route with dates, the interim controls and the compensating control for the assessor.

Technical Grounding — Linux, Cloud and Applications

Read and validate the Linux configuration that controls depend on: users and groups, sudo, SSH configuration, file permissions, cron, auditd and syslog, patch levels and running services.
Check cloud configuration on AWS, Azure or Google Cloud: IAM roles and policies, MFA, key and secret management, security groups, network segmentation, encryption, and log collection and retention.
Review firewall rules and segmentation evidence against the documented cardholder data environment boundary.
Understand how our applications are set up end to end (web and application server, database, TLS, authentication and session handling, environment separation and the release process) well enough to challenge an engineer’s answer and explain it to an auditor.
Query databases and read logs to gather evidence yourself, and write scripts that collect evidence and check configuration on a schedule.

Risk, Policy and Governance

Own the risk register: run risk assessments, record treatment decisions and follow the actions to closure.
Own the policy and procedure set. Draft in plain language, review on schedule, and keep version control and approval records straight.
Support SDLC governance: secure development requirements, code review and change approval records, and separation of development, test and production.
Run vendor and third-party security assessments. Collect supplier attestations such as PCI AOCs and SOC reports, check what they actually cover, and track what suppliers have committed to.
Run security awareness training and keep completion records.

Incident and Client Support

Complete client security questionnaires and vendor risk assessments accurately, and flag anything we cannot honestly claim.
Write the security and compliance sections of client proposals and RFP, RFI and RFQ responses, and review contract security clauses with the IT Manager.
Take part in client audits and security reviews as the compliance lead, with engineers answering the technical questions.
Support incident response on the compliance side (timelines, evidence preservation, root cause and corrective action) and run the annual incident response test.

Compliance and Office Infrastructure

Maintain the IT asset register, including laptop tracking: issue, return, ownership, location and disposal. Reconcile it against what is actually in use.
Run the approval process for infrastructure documentation, so auditors see current documents with version history, review dates and sign-off.
Handle PRFs and other internal request and approval forms: check they are complete, route them for approval and keep the records, which also serve as audit evidence.

Requirements

3–5 years’ experience in IT compliance, information security, IT audit or infrastructure with compliance duties, including two full audit cycles where you prepared evidence and dealt with the assessor directly.
Hands-on experience of ISO/IEC 27001 or PCI DSS through a full certification, surveillance or QSA cycle. You will run both here, so experience of both is a clear advantage. A SOC 2, ISAE 3402 or equivalent background is acceptable if you can show the audit cycles.
Able to run a risk assessment end to end and defend the result to an auditor.
Proficient in Linux on the command line and basic SQL: able to inspect configuration, services, logs and patch state, query data for evidence and script simple checks in Bash or Python.
Working knowledge of at least one major cloud platform (AWS, Azure or Google Cloud) and its identity, network, encryption and logging controls, and of how a typical web application is deployed: web and application server, database, TLS and authentication.
Evidence-driven and hard to fob off: comfortable asking an engineer to prove a control works, and following up when the answer is vague.
Clear written and spoken English, for documents and presentations that auditors, clients and senior management act on.
Degree or diploma in Computer Science, IT, Information Security, Engineering or a related field, or equivalent practical experience.

Advantageous

Certification: ISO/IEC 27001 Lead Implementer or Lead Auditor, PCI DSS Internal Security Assessor, CISA, CISM, CISSP or CompTIA Security+.
SOC 2 experience: the Trust Services Criteria, the difference between a Type I and a Type II report, and what an observation window means in practice.
Other assurance and certification schemes: SOC 1 or SOC 3, ISAE 3000 or ISAE 3402, ISO/IEC 27017 or 27018 for cloud services, CSA STAR, or TISAX.
Other frameworks and regulations: ISO 22301, NIST Cybersecurity Framework, CIS Controls, Bank Negara Malaysia RMiT, or the Malaysian Personal Data Protection Act.
Experience as the day-to-day contact for a QSA or an external certification body.
Exposure to contact-centre or telephony environments, including call recording and its PCI DSS scope.
Exposure to GRC or compliance tooling, and to vulnerability management platforms.
Experience in financial services, payments or another regulated sector.

Working Arrangements

Based at our Kuala Lumpur office, Vertical Bangsar South, on standard office hours.
Occasional out-of-hours and weekend work around audit windows, assessments, DR drills and evidence deadlines.
Occasional onsite work at data centres and client premises, including physical security walkthroughs.

Pay: RM4,000.00 - RM6,000.00 per month

Benefits:

Health insurance
Opportunities for promotion
Professional development

Work Location: In person

Gsc Jobs in Bangsar South - November 2026 - Urgent Hiring

Manage Alert

L2 Compliance Engineer