GRC Specialist (資安治理專員)

About the role: As a GRC Specialist, you will play a key role in driving information-security awareness and supporting the broader Governance, Risk & Compliance (GRC) program. Partnering with IT, HR, and business teams, you will help ensure employees understand and adhere to security policies, processes, and regulatory requirements. You will also provide hands-on support for risk assessments, audits, and related compliance activities. (身為 GRC 專員，您將在推動資訊安全意識及支援更廣泛的治理、風險與合規(GRC)計劃中扮演關鍵角色。您將與 IT、HR 及業務團隊合作，確保員工理解並遵循安全政策、流程及法規要求。同時，您也將提供實務支援，包括風險評估、稽核及相關合規活動) What this job involves: [Security Awareness & Training]: 1. Develop the annual security training calendar for new hires and existing staff (e.g., password hygiene, phishing awareness, data classification, remote work security). (制定年度資安訓練計畫，涵蓋新進員工及在職員工(如密碼使用習慣、釣魚郵件辨識、資料分類、遠端工作安全等)) 2. Design diverse learning materials, including micro e-learning, workshops, quizzes, posters, and intranet articles. (設計多元學習素材，包括微型線上課程、工作坊、小測驗、海報與內部網站文章) 3. Conduct and monitor phishing simulations; analyse results and recommend improvements. (執行並追蹤釣魚模擬演練；分析結果並提出改進建議) [Policy & Document Support]: 1. Assist in updating security policies, standards, and procedures to meet ISO/IEC 27001, PCI-DSS, and internal requirements. (協助更新資訊安全政策、標準及程序，以符合 ISO/IEC 27001、PCI-DSS 及內部規範) 2. Manage the policy repository and version control; ensure staff access to current documents. (管理政策文件庫與版本控制；確保員工能隨時取得最新文件) [Risk & Compliance Assistance]: 1. Collect and organise data for the enterprise risk register; classify and follow up on low- to medium-level risks. (收集並整理企業風險登錄表的資料；進行風險分類並跟進低至中等級風險) 2. Support evidence collection for internal and external audits (e.g., ISO 27001 certification, PCI-DSS reviews). (協助蒐集內外部稽核所需證據(如 ISO 27001 認證、PCI-DSS 審查等)) [Data & Reporting]: 1. Compile training completion rates, quiz scores, and phishing results; provide monthly metrics to the GRC Manager. (彙整訓練完成率、小測驗成績及釣魚測試結果；每月提交相關數據給 GRC 經理) 2. Use basic visualisation tools (Excel, Power BI) to report security awareness trends. (使用基礎視覺化工具(Excel、Power BI)呈現資安意識趨勢) [Continuous Improvement]: 1. Gather employee feedback and regularly assess training effectiveness. (收集員工回饋並定期評估訓練成效) 2. Track emerging threats and best practices; integrate relevant topics into future training. (追蹤新興威脅與最佳實務，並將相關主題納入未來訓練)