Your career compass awaits
Create a free account to unlock
- ✓ See how you match this role
- ✓ AI resume tailored to this specific job
- ✓ Inside Track Companion — find your insider contact
- ✓ Skills gap analysis and upskill plan
- ✓ Interview prep kit for this role
- ✓ Relocation concierge — salary, tax, cost of living
Free — no credit card required
Senior Governance, Risk, and Compliance (GRC) and Security Compliance Engineer
ICT
💰 Salary Not shared
📊 Market RM10,000–RM16,000/mo (RM120,000–RM192,000/yr)
About the Company
Anywhere, with you. At Doctor Anywhere, we are guided by the core belief that healthcare should be simple, accessible and efficient for everyone. Since our launch in 2017, we've been disrupting the healthcare industry by developing innovative solutions to bridge gaps in the healthcare ecosystem. Our services integrate both digital and offline platforms to empower users to take charge of their health. Headquartered in Singapore, we have regional offices in Malaysia, Thailand, Philippines, Vietnam, Indonesia, and India, serving more than 2.5 million (and growing) users across Asia. If you are excited to be at the forefront of health-tech innovation, and passionate about creating meaningful change, join us at https://doctoranywhere.bamboohr.com/jobs/ Hospitals and Health Care Specialties: Healthcare, Health and Wellness, Mobile Technology, Telehealth, Telemedicine, Healthtech, Health Care
About the Role
Doctor Anywhere is one of Southeast Asia's largest technology-led healthcare companies. We run consumer telehealth, clinics, and integrations with insurers and payers across the region. Our platform holds patient data, so the standard we are held to by clients, partners and regulators is high, and it is rising. We are rebuilding our governance, risk and compliance function around automation and evidence, and we are looking for a senior engineer-minded practitioner who will own it. You will inherit an ISO/IEC 27001 certified environment with a real policy library and a mature application security pipeline, and you will be given the mandate to modernise how compliance actually runs: a reusable answer library, AI-assisted first-draft responses with proper controls around them, and evidence pulled live from our cloud and identity systems instead of assembled by hand. You will report to the Director of Security and Platform Engineering , and you will be the person the business relies on when an enterprise client, an insurance partner, an auditor or a regulator asks how we secure their data.
Responsibilities
- ● Client trust response. Security questionnaires, RFP security sections, enterprise client audits and supplier due diligence. You will answer most technical questions yourself rather than relaying them to engineers.
- ● Compliance automation. Build the canonical answer library, own AI-assisted drafting with citation, confidence thresholds and mandatory human sign-off, and integrate read-only evidence collection from cloud, identity and network systems so evidence is generated rather than screenshotted.
- ● Certification and audit. Own the ISO/IEC 27001:2022 lifecycle end to end: scope, Statement of Applicability, internal audit programme, management review, external auditors and corrective action.
- ● Risk, policy and third party. Run the information security risk register as a decision-making tool, own the policy lifecycle and exception register, and assess the vendors and partners we integrate with.
- ● Incident response and regulatory notification. Own breach assessment and the notification decision across the jurisdictions we operate in, alongside Legal. In healthcare this is the highest consequence judgement in the role.
- ● Finding what is broken before someone else does. Go looking. Read the infrastructure code, pull the access review output, check that the alert a policy promises is actually configured. When you find a gap, bring it quantified, costed and sequenced.
Requirements
- ● 6 or more years in security governance, risk and compliance, including at least 2 years responding directly to enterprise or regulated clients.
- ● You have owned a certification or attestation, ISO/IEC 27001 or SOC 2, rather than supported one. You can describe the scope decisions you made, including one you would make differently.
- ● Real cloud fluency. You understand the architecture, its building components, and reason about what it exposes. You understand IAM, key management, network segmentation, logging and container security well enough to assess a control rather than describe it.
- ● Fluency with SIG, CAIQ, VSA or equivalent questionnaire frameworks, from the answering side.
- ● Technical credibility with engineers. You can disagree with a senior engineer about whether a control is effective, and be right often enough that they listen.
- ● An evidence-first instinct. Your default response to a control claim is to ask what proves it, and a policy document does not satisfy you.
- ● Written English strong enough to go to a client with light review.
- ● The judgement to say no to a client accurately, offer the compensating control, and keep the relationship intact.
- ● Healthcare, insurance, payer or financial services background.
- ● Scripting or automation ability, Python or similar, comfortable with APIs. Not a requirement, but you will move considerably faster here with it.
- ● Hands-on with a compliance automation platform such as Vanta or Drata, including its limits.
- ● Practical experience applying AI tooling to compliance work, with the controls that responsible use requires.
- ● Privacy depth in Southeast Asia.
- ● Incident response experience where you made or advised a regulatory notification decision under time pressure.
- ● CISA, CISM, CRISC, ISO 27001 Lead Auditor or Lead Implementer, CIPP/A, CCSK or AWS Security Specialty.
- ● A start-up attitude - you take full ownership of what you do, put the best tools (AI included) to work to move faster, and you're happy to step out of your comfort zone and take on new challenges.
- ● Comfortable with ambiguity and quick to learn - you experiment with AI to work smarter, not just harder, because we're not done growing, and heading into uncharted territory is part of the fun.
- ● DA's goal is to build a regional digital healthcare ecosystem, advanced by the 3,000 GPs and specialists within our regional network, over 1,500 corporate organisations, and 25 regional insurers we work with. Grounded in our motto "Keep Going, Keep Growing", our team strives towards excellence, with innovation and collaboration at our core, and values the diversity of perspectives brought by every member. Join us in our mission to transform Southeast Asia's healthcare future
Confirm Application
Are you applying to ?
We'll track this in your dashboard as Applied.
Saving to your tracker…
Stand out: message someone at Doctor Anywhere.
A short, personal note to a recruiter can get your application looked at sooner.
⚡ Full Resume Sandbox Canvas