Maybank Hiring! Full Time Security and Governance Specialist, Automation in Federal Territory - Ricebowl

ROLE FOCUSBuild and scale secure, governed and reusable automation capabilities across the bank, covering technology infrastructure, cloud, network, security, applications, service operations, resilience, data and suitable business processes.

Job Title

Security and Governance Specialist, Automation

Reporting To

Automation Platform Owner

Department

Enterprise Automation

Hiring Phase

Year 2

Employment Type

Permanent / Full-time

Location

Malaysia / as assigned

1. Job Purpose

Embed security, risk, compliance, privacy, auditability and governance controls across the enterprise automation lifecycle. Translate control requirements into practical standards, evidence, access models and assurance activities without unnecessarily constraining delivery.

2. Principal Accountabilities

Accountability

Supporting Activities

Expected Outcomes

Control framework

Define automation control requirements, lifecycle checkpoints, evidence and ownership.

Consistent and auditable governance across use cases.

Identity and access

Govern RBAC, segregation of duties, privileged access, service accounts, credentials and recertification.

Least-privilege access and controlled execution.

Security assurance

Coordinate threat/risk assessments, secure design reviews, vulnerability findings and remediation.

Security risks identified and treated before production.

Compliance and audit evidence

Maintain control mapping, exceptions, decisions, attestations and audit responses.

Reliable evidence for risk, compliance and audit review.

Governance enablement

Provide practical patterns, templates and training to engineering and use-case owners.

Controls are understood and applied consistently.

3. Success Measures

Access, credential and segregation controls operate as designed.

Material findings are remediated within agreed timelines.

Audit and regulatory evidence is complete, traceable and readily retrievable.

Engineering teams adopt control templates with fewer late-stage issues.

4. Qualifications and Experience

Bachelor degree in Cybersecurity, Information Technology, Risk, Engineering or related discipline.

Typically 6+ years in technology security, risk, governance, compliance or audit within a large regulated enterprise.

Experience with privileged access, RBAC, secure SDLC, change controls, cloud/infrastructure security and audit evidence.

Ability to translate policies into implementable technical controls.

CISSP, CISM, CRISC, CISA, ISO 27001, cloud-security or equivalent certifications are advantageous.

5. Technical and Functional Competencies

Identity, RBAC, segregation of duties, service accounts, secrets and privileged-access management.

Secure automation lifecycle, code repositories, pipeline controls, approvals and evidence retention.

Threat modeling, vulnerability management, risk assessment and control testing.

Logging, audit trails, monitoring, data protection and incident-response integration.

Knowledge of AAP/Ansible, APIs, Git/CI/CD, infrastructure and cloud control models.

6. Behavioral Competencies

Enterprise mindset with strong accountability and delivery discipline.

Clear written and verbal communication, including executive and technical audiences.

Ability to challenge constructively, make evidence-based decisions and manage ambiguity.

Collaboration across business, technology, architecture, security, risk, operations and vendors.

Commitment to documentation, knowledge transfer and continuous