Salmon Group

GRC Lead

Serbia, Remote. Posted a month ago

The role

You will build one ISMS framework for the whole Salmon Group to extend to every new regulation, licence, entity or market. You will run core GRC processes, lead a GRC Engineer, and report to the Group CISO.

What you will do

  • Run core GRC processes and lead a GRC Engineer
  • Work with various teams to apply one set of controls across every Group entity
  • Keep ISO/IEC 27001:2022 certification and PCI DSS v4.0.1 compliance
  • Act as the main contact for the certification body and the QSA
  • Own the common controls framework including control catalogue and risk and control matrices
  • Track changes in regulations and standards
  • Define how a new entity, licence, product or market joins the framework
  • Run information security risk management including methodology, risk register, and assessment
  • Own the policy lifecycle, exception process, and third-party security risk methodology
  • Define how controls are tested, automate control checks, and implement a GRC platform

Required qualifications

  • 6+ years in information security GRC
  • 2+ years leading a GRC function or programme
  • Track record of building or scaling a GRC programme
  • Hands-on experience taking an ISO/IEC 27001 ISMS through certification and surveillance audits
  • Practical PCI DSS experience
  • Experience in regulated financial services (banking, payments or lending)
  • Working knowledge of ISO/IEC 27005 or NIST SP 800-30
  • Clear writing for senior management
  • Daily use of AI tools to build automations with AI-assisted coding

Nice to have

  • Building or scaling a GRC programme ideally around a common controls framework and RCMs mapped to several standards
  • PCI DSS experience ideally v4.0.1 in a payments or service provider environment

Benefits

  • Fully remote work
  • Company-provided tools and equipment
  • Medical insurance support for you and your family through co-funding or reimbursement
  • Access to an internal mental health support specialist
  • 22 vacation days
  • Philippine public holidays
  • 15 sick days
  • Opportunities to learn and share expertise through internal meetups, external conferences, speaking opportunities, and industry publications
  • Company-sponsored trips to Manila to meet and work with your team in person
  • High-performing teams can earn a dedicated beach house week in Southeast Asia

About the company

Salmon is a technology-driven financial company building a banking and lending platform across Southeast Asia. The team is Manila-based, globally distributed, and hybrid-first.