GRC Analyst

Be part of a leading Australia-based healthcare organisation, empowering a 24/7 network of 3,000+ clinics that support millions of patients worldwide.

The Opportunity

Drive data transformation across the organisation — automate manual reporting, redesign fragmented workflows, and build reliable analytics pipelines that power smarter business decisions. Partner closely with stakeholders in Australia, elevate data integrity standards, and help shape a modern, scalable data environment where insights move faster than spreadsheets ever could.

Why join us?

• Proudly Great Place to Work® certified
• Celebrate globally: Company trips (2025: Hong Kong, 2024: Thailand), Culture Champs, Year-end parties, leadership awards & more
• Grow with stability: 100+ in our 10-Year Club by 2025
• Dynamic talent network: 2,000+ across APAC and beyond
• Competitive compensation with annual reviews
• Comprehensive medical care for you and your family
• Generous paid leave because work-life balance matters
• Level up with LinkedIn Learning and tailored training
  
  
  

• Support third-party audits, customer audits, internal audits, and external audits when required.
• Review vendor responses and assess third-party security/compliance posture using internal questionnaires and evidence.
• Respond to customer audit requests and security questionnaires, including gathering and validating evidence.
• Work with internal business, technology, cybersecurity, and control owner teams to collect information and keep controls updated.
• Maintain and update the control library, risk register, and audit evidence records.
• Support SOP / hygiene security audits, including account reviews and user access reviews.
• Work across Corporate and different brands depending on audit/risk priorities.
• Use tools such as UpGuard for vendor assessments and OneUp for customer audit questionnaire responses.
  
  
  

• At least 3+ years of experience in GRC Analyst role or related role
• GRC / IT Audit / IT Assurance Experience: Candidate must have hands-on experience in GRC, IT audit, IT assurance, or cybersecurity compliance.
• ISO 27001 and NIST Understanding: Strong understanding of ISO 27001 is important. NIST experience is preferred, but candidate does not necessarily need to have led a NIST assessment, should understand key areas and how to apply them in a real business environment.
• Third-Party Risk Management: Experience with vendor assessments, questionnaires, reviewing vendor evidence, and understanding third-party security/compliance risks.
• Identity and Access Management / ITGC Understanding: Good understanding of IAM concepts, user access reviews, account reviews, and IT general controls.
• Clear Written Communication: Candidate must be able to write clear emails, respond to customer/vendor audit questions, explain evidence, and follow up independently without needing the manager to rewrite communications.
• Resourcefulness and Ownership: Able to find answers proactively by checking previous evidence, asking the right internal teams, and taking initiative rather than waiting for step-by-step instructions.
  
  
  

• Philippines (Taguig - BGC): Philippines business hour (6 am – 3 pm) with a fully remote setup