Manager, Governance, Risk and Compliance

Manager, Governance, Risk and Compliance - Asia and Emerging Markets

Thomson Reuters is seeking a Manager, Governance, Risk and Compliance to join our Governance, Risk and Compliance team, supporting the Asia and Emerging Markets (AEM) region spanning APAC, the Middle East, Africa, and Japan. The role is based in Melbourne.

About the Role

As the primary compliance and assurance lead for the region, you will:

• Lead and coordinate the AEM region's compliance audit program, including ISO 27001, ISO 9001, ISO 42001, SOC 1, SOC 2 Type II, and IRAP assessments, managing auditor relationships, evidence collection, findings, and corrective actions.
• Review and negotiate information security obligations within customer contracts, including non standard commitments, working closely with Legal and securing appropriate approvals where required.
• Maintain SOPs and support process alignment between Customer Assurance and GRC, contributing to continuous improvement of operational workflows.
• Build and maintain strong relationships with internal stakeholders, including Legal, BISOs, Product Teams, and Global Compliance, as well as external auditors and customers across the AEM region.
• Drive risk management and compliance activities across assigned technology platforms by interpreting and applying relevant regulatory, legal, contractual, and security requirements.
• Conduct and support information security risk assessments, identify control gaps, and develop remediation plans aligned with Thomson Reuters' global frameworks.
• Monitor the regulatory landscape across APAC, the Middle East, Africa, and Japan, while promoting security awareness, compliance culture, and opportunities for automation and continuous improvement.

Qualifications

• Proven experience in information security governance, risk and compliance, cybersecurity compliance, or technology risk, preferably within a large national or global organisation.
• Strong working knowledge of security and compliance frameworks, including ISO 27001, ISO 9001, SOC 1, SOC 2 Type II, and IRAP.
• Demonstrated experience managing compliance audit programs, coordinating with external auditors, overseeing evidence collection, and tracking findings through to remediation.
• Experience reviewing and negotiating information security clauses in customer contracts, partnering with Legal to manage non standard or exceptional commitments.
• Familiarity with regulatory, privacy, and data protection requirements across APAC, the Middle East, Africa, and/or Japan.
• Experience using GRC platforms or risk management tools, such as Protecht or equivalent, to manage audit evidence, corrective actions, risks, and findings.
• Strong stakeholder management, communication, and influencing skills, with the ability to manage customer escalations, produce executive ready reporting, lead initiatives, and work independently while continuously adapting and learning.

Preferred Qualifications

• Professional certifications such as CISSP, CISM, CRISC, ISO 27001 Lead Implementer / Lead Auditor, or CISA.
• Experience with cloud environments such as AWS, Azure, or Google Cloud Platform.
• Knowledge of privacy and data protection regulations relevant to the AEM region (e.g., PDPA, PIPL, POPIA, UAE PDPL, or equivalent).
• Experience working in or supporting highly regulated industries such as financial services, legal, or media.
• Familiarity with AI governance and responsible AI risk frameworks.

Benefits

• Hybrid Work Model: flexible hybrid working environment with 2 3 days a week in the office.
• Flexibility & Work Life Balance: "Flex My Way" policies and work from anywhere up to 8 weeks per year.
• Career Development and Growth: continuous learning and skill development programmes.
• Industry Competitive Benefits: flexible vacation, two company wide Mental Health Days off, access to the Headspace app, retirement savings, tuition reimbursement, employee incentive programmes, and wellbeing resources.
• Culture: focus on inclusion and belonging, flexibility, work life balance, and strong values.
• Social Impact: paid volunteer days off and ESG initiatives support.

Equal Employment Opportunity

Thomson Reuters is proud to be an Equal Employment Opportunity Employer providing a drug free workplace. We seek talented, qualified employees in all our operations around the world regardless of race, color, sex or gender, pregnancy, gender identity and expression, national origin, religion, sexual orientation, disability, age, marital status, citizenship status, veteran status, or any other protected classification under applicable law. We also make reasonable accommodations for qualified individuals with disabilities and for sincerely held religious beliefs in accordance with applicable law.