GRC Specialist - Junior / Middle

Job Responsibilities

Participate in the implementation, maintenance, development, and continuous improvement of the Bank’s Information Security Management System (ISMS).

Participate in identifying, assessing, treating, and monitoring information security and cybersecurity risks; maintain and regularly update the Information Security Risk Register.

Participate in the development, review, updating, and version control of information security policies, standards, procedures, guidelines, and other internal regulatory documents.

Contribute to ensuring the Bank’s compliance with ISO/IEC 27001 and ISO/IEC 27002 standards, the legislation of the Republic of Armenia, requirements of the Central Bank of Armenia, and other applicable regulatory and internal requirements.

Participate in defining and documenting applicable security controls and assessing their implementation and effectiveness.

Participate in internal and external audits, compliance assessments, and certification processes by collecting, analyzing, organizing, and presenting the required information and evidence.

Record and monitor nonconformities, observations, and improvement recommendations identified during audits, compliance assessments, and other reviews.

Monitor the status, responsible parties, and deadlines of identified gaps, risk treatment plans, and corrective actions.

Participate in information security risk assessments for new information systems, services, projects, and significant technological changes.

Participate in third-party and vendor information security risk assessments and in defining relevant security requirements.

Participate in developing, collecting, and analyzing metrics and indicators related to information security processes, controls, risks, and compliance (Metrics / KPI / KRI).

Prepare periodic reports and management materials on information security risks, compliance, audits, controls, and corrective actions.

Participate in developing and implementing information security awareness programs for the Bank’s employees.

Collaborate with the Department and other Bank units on information security requirements and GRC processes.

Required Qualifications and Skills

Knowledge and/or practical experience in Information Security GRC, Information Security, IT Risk, IT Audit, Compliance, Internal Control, or related fields. For the Middle level, at least 2 years of relevant work experience is preferred.

Higher education or equivalent professional experience in information security, cybersecurity, information technology, computer science, risk management, auditing, or a related field.

Knowledge of ISO/IEC 27001 and ISO/IEC 27002 standards, ISMS, and the fundamental principles of information security management.

Understanding of the key information security risk management processes: Risk Identification, Risk Assessment, Risk Treatment, Risk Acceptance, and Risk Monitoring.

Understanding of the fundamental principles of security controls, their objectives, implementation, and effectiveness assessment.

General understanding of the development of, or work with, information security policies, standards, procedures, and other internal regulatory documents.

Knowledge of the fundamental principles of auditing and compliance assessments, evidence collection and retention, and Audit Findings / Nonconformities and Corrective Actions processes.

General understanding of key IT and information security processes, including Access Control, Identity & Access Management, Network Security, Vulnerability Management, Incident Management, Logging & Monitoring, Change Management, Backup, Business Continuity, and Disaster Recovery.

Ability to research and analyze Armenian legislative and regulatory requirements in information security and cybersecurity and assess their applicability to the Bank’s processes.

Ability to analyze, organize, and clearly document large volumes of information.

Skills in preparing and presenting structured official documents, including policies, procedures, reports, and risk assessments.

Ability to communicate technical requirements and information security risks in a way that is understandable to business stakeholders.

Analytical and structured thinking, attention to detail, responsibility, organizational skills, and the ability to meet deadlines.

Ability to communicate and collaborate effectively with technical and non-technical departments.

Ability to handle confidential and restricted-access information appropriately and adhere to professional ethics.

Preferred Qualifications

Experience in Information Security GRC, IT Risk, IT Audit, Internal Control, or Compliance within a bank, financial institution, or other regulated organization.

Experience participating in ISO/IEC 27001:2022 implementation, maintenance, certification, surveillance audits, or internal audits.

Knowledge of the Central Bank of Armenia’s requirements related to information security, cybersecurity, IT, and operational risks.

Knowledge of ISO/IEC 27005, ISO 31000, NIST Cybersecurity Framework (CSF), NIST Risk Management Framework (RMF), CIS Controls, or COBIT.

Knowledge of PCI DSS and the SWIFT Customer Security Controls Framework (CSCF), or practical experience working with these requirements.

Experience implementing Third-Party / Vendor Risk Management processes.

Experience working with GRC documentation, including Information Security Risk Registers, Control Matrices, Statements of Applicability (SoA), Audit / Corrective Action Trackers, and related documents.

Experience working with GRC platforms or Risk / Compliance Management systems.

Experience developing information security metrics, KPI/KRI indicators, and management reports.

Relevant professional certifications, such as ISO/IEC 27001 Foundation, ISO/IEC 27001 Lead Implementer / Lead Auditor, CISA, CRISC, CISM, or equivalent.

Participation in professional training and development programs offered by ISACA, ISC2, PECB, BSI, SANS Institute, or other reputable organizations specializing in Information Security Governance, Risk Management, Audit, and Compliance.

What We Expect from the Candidate

A structured and analytical approach to information security management, the ability to understand, analyze, and document risks and compliance requirements, and a commitment to continuously developing knowledge in Information Security GRC, Risk Management, and Compliance.

The candidate should be able to understand not only whether a requirement or control exists, but also its purpose, the associated risk, and its practical application. The ability to collaborate effectively with technical and non-technical departments and translate information security requirements into practical, measurable, and controllable measures is essential.

The primary focus is on Penetration Testing, while Red Team / Adversary Emulation is considered an additional area to be developed progressively.

Application period

Start date: September 2, 2026

Closing date: October 15, 2026