GRC Manager CA
Job Summary
The GRC Manager will oversee regulatory compliance and audit management within a Certification Authority (CA) environment. The role involves managing governance documentation, such as Certificate Policies (CP) and Certification Practice Statements (CPS), to ensure alignment with international standards. Additionally, the position is responsible for monitoring operational risks and coordinating external audits to maintain the integrity of trust services.
Responsibilities
- Manage regulatory compliance for Digital Signature Act and MCMC guidelines.
- Oversee international CA standards (WebTrust, ISO 27001, ETSI) and coordinate audits.
- Develop and maintain CP, CPS, and operational governance documentation.
- Perform operational risk assessments and monitor PKI/cryptographic controls.
Required Skills
- PKI and X.509 Certificate expertise
- GRC and Audit Management
- ISO 27001 / WebTrust framework knowledge
- Analytical and policy development skills
Job Details
Regulatory Compliance Management
- Ensure compliance with: Digital Signature Act 1997, Malaysian Communications and Multimedia Commission (MCMC) guidelines, and relevant industry/cybersecurity regulations.
- Monitor regulatory updates and implement necessary compliance changes.
- Liaise with regulators, government agencies, and relevant authorities.
Standards, Certification & Audit Management
- Ensure compliance with international Certification Authority (CA) standards including: WebTrust for Certification Authorities, ETSI EN 319 411, ISO/IEC 27001, and CA/Browser Forum Baseline Requirements.
- Coordinate and manage external audits, internal compliance reviews, audit remediation, and corrective action plans.
- Track audit findings and ensure timely resolution.
Policy & Governance Management
- Develop, review, and maintain governance documents including: Certificate Policy (CP), Certification Practice Statement (CPS), compliance policies, and operational procedures.
- Manage document versioning, publication, and repository obligations.
Risk & Compliance Monitoring
- Conduct compliance and operational risk assessments.
- Monitor adherence to certificate issuance and revocation processes, key management procedures, and cryptographic/security controls.
- Identify compliance gaps and implement corrective actions and process improvements.
Operational Oversight (Trust Services)
- Oversee governance and compliance of trust service operations, including identity verification/eKYC processes, digital certificate lifecycles, and key management.
- Coordinate incident response and breach management activities.
Reporting & Stakeholder Management
- Prepare compliance and governance reports for senior management.
- Monitor SLA performance with partners and customers.
- Act as the primary liaison for auditors, regulators, and enterprise clients.
- Support customer due diligence and compliance assurance activities.
Requirements
- Bachelor’s Degree in Information Technology, Cybersecurity, Computer Science, Engineering, or a related discipline (candidates without a degree may be considered with strong experience).
- Professional Certifications (Preferred): CISA, CISM, CISSP, ISO 27001 Lead Auditor, or other relevant certifications.
- Experience: Proven experience in GRC, cybersecurity governance, audit, or CA operations; familiarity with PKI environments and digital certificate operations is highly preferred.
- Technical Knowledge: Strong understanding of PKI, X.509 digital certificates, cryptographic controls, HSM, PQC concepts, and compliance frameworks.
- Soft Skills: Strong analytical and critical thinking, attention to detail, excellent communication, and the ability to work independently.