GRC专员
GRC SPECIALIST
1) 最低要求为学士学位或持有相关专业资格或在信息安全（GRC）领域有相关经验（通常至少6年）。
2) 具有学士学位，持有相关专业资格，可能还拥有研究生学历，如MSc、MBA或其他相关商业、工程、科学或行业资格。
3) 具备以下知识和经验：
a. 将特定的质量标准应用于所有任务，以确保交付成果准确且完整。
b. IT审计的原则、实践、工具和技术。
c. 按照既定计划报告进度和财务合规性的方法和技术。
4) 具备以下技术和业务技能：
a. 能够良好地进行口头和书面沟通，并能在正式场合通过说服力影响他人。具备对信息系统实践和应用广泛领域的整体了解。理解在标准合规方面保持实际和务实方法的必要性
b. 用于管理组织IT实践中质量的系统或方法，包括质量规划、保证和控制。
1) 监控风险状态，并向高级同事报告状态及需要采取的行动。
2) 在风险管理中表现出财务意识（例如，对拟议的应对措施进行成本效益分析）。
3) 协助制定商定的应对措施和应急计划。
4) 收集和整理证据，作为正式开展和计划的活动、流程、产品或服务审查的一部分，包括信息和通信技术应用。
5) 根据指定的测试策略检查记录，以获取符合管理指令的证据，或识别异常情况。
最初发布于Himalayas
查看英文原文
1) Minimum bachelors degree level or holds a relevant professional qualification or relevant experience (typically at least 6 years) in information security (GRC).
2) Educated to bachelors degree level, holds a relevant professional qualification, and may have a postgraduate qualification such as an MSc, MBA, or other appropriate business, engineering, scientific or industry qualification.
3) Have knowledge and experience as below:
a. Applying specific quality standards to all tasks undertaken to ensure that deliverables are accurate and complete.
b. Principles, practices, tools, and techniques of IT auditing.
c. Methods and techniques for reporting progress and financial conformance against an agreed plan.
4) Have technical and business skills as below:
a. Communicate well, both orally and in writing, and has the skill to influence through persuasion in a formal context. Has a good overall knowledge of wide areas of information systems practice and applications. Understands the need to maintain a practical and pragmatic approach to standards compliance
b. The system or method for the management of quality within the employing organizations IT practices, including quality planning, assurance, and control.
1) Monitor status of risks, and reports status and need for action to senior colleagues.
2) Demonstrate financial awareness as a part of risk management (e.g., cost-effectiveness analysis of proposed counter measures).
3) Assist with development of agreed countermeasures and contingency plans.
4) Collect and collate evidence as part of formally conducted and planned reviews of activities, processes, products, or services, including information and communications technology applications.
5) Examine records as part of specified testing strategies for evidence of compliance with management directives, or the identification of abnormal occurrences.
Originally posted on Himalayas