GRC Analyst - Governance | Risk and Compliance Analyst (Information Security Department)
About the role
The GRC Analyst (Governance, Risk, and Compliance Analyst) in the Information Security Department at Cargills Bank is responsible for maintaining and coordinating the Information Security Management System (ISMS) documentation, managing policy lifecycles, and supporting security risk assessments and compliance activities. The role involves ensuring accurate tracking of risk registers, supporting compliance monitoring, preparing evidence for audits, and assisting with third-party security due diligence. The analyst will also support regulatory engagements and information security committee activities.
Must have
- Strong knowledge of ISO/IEC 27001, 27002, 27701, 20001, and 42001 controls and integrated management system operations
- Familiarity with NIST CSF and related control frameworks
- Understanding of CBSL technology risk expectations and practical compliance within a Sri Lankan banking context
- Awareness of Sri Lankan Personal Data Protection Act (PDPA) obligations, PCI DSS, and SWIFT CSP requirements
- Hands-on experience in supporting risk assessments, RCSAs, control testing, and remediation tracking
- Strong coordination and stakeholder management skills across Technology, Risk, Compliance, Internal Audit, and external vendors
Technologies
- NIST
- PCI DSS
Highlights
Interested candidates are invited to forward their CVs to career@cargillsbank.com mentioning the post applied for in the subject line of the email on or before 02nd November 2026. The position is based in Colombo, Sri Lanka.
Jobs across Sri Lanka, watched for you.Colombo, Sri Lanka