Infosec and Compliance Officer

Mekari is Indonesia's no. 1 Software-as-a-Service (SaaS) company. With our ecosystem of software solutions—including Mekari Jurnal, Mekari Talenta, Mekari Qontak, and Mekari Flex, we aim to facilitate entrepreneurs and leaders as they accelerate the digital transformation of their businesses.

In our 10+ years of journey we have reached over 3 Million platform users, and we're not planning to stop any time soon. We need more people like you: builders and owners with calculated ambition who are ready to #ElevateThroughImpact and raise Indonesia's software standard.

About this role

This is an early-career role for someone looking to build a career in Information Security Governance, Risk, and Compliance (GRC), with a strong focus on AI, automation, and continuous improvement.

You will support Mekari's security governance and compliance programs across our SaaS and financial services products. Your responsibilities include maintaining compliance evidence, supporting audits, conducting vendor security assessments, maintaining policies, and ensuring proper oversight of access and asset management.

Success in this role is measured by the accuracy and timeliness of your work, effective coordination with stakeholders, and your ability to independently learn and adapt to evolving security standards, frameworks, and technologies.

We expect you to be proactive, detail-oriented, and a builder at heart: when you see a manual, repetitive, or error-prone step, you build the script, workflow, or tool that removes it, using AI and automation to improve efficiency and reduce manual work. This role provides opportunities to develop deeper expertise in security governance, compliance, and AI governance as you grow within the team.

What you will do

• Maintain the unified control set: keep control descriptions, owners, and evidence links current, and support mapping to ISO 27001:2022 Annex A, ISO 27701, UU PDP, PJP, and DJP requirements so one artifact serves every framework.
• Run periodic user access reviews and keep the asset and information classification registers current, chasing owners to completion and recording the evidence; support incident response by assembling the evidence needed for UU PDP breach notification decisions.
• Support audit readiness and execution: collect and organize evidence packs, coordinate with control owners and auditors, track findings to closure, and use AI-assisted evidence preparation so each ISO 27001, ISO 27701, regulatory, customer, and partner audit cycle is faster than the last.
• Maintain the IT policy and procedure library: draft updates, manage versions and review cycles, publish, and track acknowledgement of security and privacy policies.
• Run first-line third-party security due diligence: tier vendors, send and review security questionnaires, flag findings to InfoSec leadership, and operate the automated vendor risk analysis workflows.
• Help operate and improve the GRC platform: keep control and evidence records current, triage continuous monitoring alerts, maintain data quality, and propose and build automations that remove manual steps from the workflow.
• Support AI governance: maintain the AI use case and AI vendor inventory, run intake assessments against the AI governance framework, and track approved and restricted uses.

• Bachelor's degree in Information Systems, Computer Science, Cyber Security, or a related field, and 0 to 2 years of experience in GRC, IT audit, information security, or compliance, including relevant internships.
• Basic understanding of ISO 27001 and what a control, a risk register, and an audit finding are; exposure to an ISO 27001, ISO 27701, or SOC 2 audit is a plus.
• Practical automation habit: comfortable with Google Sheets or Excel formulas and at least one of Apps Script, basic Python, or no-code automation tools. You should arrive with one example of something you automated, however small.
• Daily use of AI assistants and LLM tooling for drafting, summarizing, and analysis, with the judgment to verify outputs before relying on them.
• Clear written and spoken communication in Bahasa Indonesia and English; you will sit in auditor interviews and follow up with control owners directly.
• Organized and detail-oriented, able to track several deadlines in parallel and follow through with control owners without being reminded.
• Continuous learning mindset: you read standards, regulatory updates, and tooling changes on your own initiative, build working knowledge fast, and can show what you taught yourself in the last year.
• Builder mentality: you default to making things rather than waiting for them. Given a recurring compliance task, you prototype a fix, test it on real work, and ship it, then improve it. Bring examples of things you have built, even small ones.
• Comfortable handling confidential employee and customer information with strict discipline; background screening applies to this role.
• Certifications such as ISO 27001 Foundation or Lead Implementer are a plus, not a requirement.

Our team will review your application and will be in touch if your application is shortlisted to the next stage. If you do not hear from us in 30 days, we will keep your resume on file in case a relevant opportunity opens up.

Don't forget to check our Recruitment FAQ at bit.ly/FAQMekariHiringENG or bit.ly/FAQMekariHiringINA to find the answers to commonly asked questions regarding our recruitment process.

We wish you the best. Hope to see you around soon!