全职 Senior Executive, IT Risk and Governance 工作, 薪水 up to MYR 6,800, Safeguards Corporation Selangor 公司招聘中 - Ricebowl

The IT Risk & Governance is responsible for establishing, implementing, and maintaining the organization's IT governance, risk management, and compliance (GRC) framework. The role ensures that IT operations, information security, and technology initiatives comply with regulatory requirements, internal policies, and industry best practices while supporting business objectives and minimizing technology-related risks.

Key Responsibilities:

IT Regulatory Compliance and Control Monitoring

• Support the implementation, maintenance and continual improvement of the IT Governance, Risk and Compliance (GRC) framework.
• Monitor compliance with applicable regulatory requirements, including BNM RMiT where applicable, PayNet requirements, PDPA obligations, contractual commitments and internal policies.
• Ensure compliance with internal policies, regulatory requirements, contractual obligations, and applicable industry standards.
• Monitor changes to applicable regulatory and industry requirements and assess potential impacts on SSS’s IT policies, processes and controls.
• Maintain regulatory and compliance registers, obligations mapping, compliance calendars and submission trackers.
• Coordinate periodic compliance assessments, identify control gaps and follow up with relevant stakeholders on remediation actions

IT Risk Management

• Maintain overall enterprise IT risk registers, risk assessment records, risk treatment plans and risk acceptance documentation.
• Coordinate periodic IT risk assessments, including technology end-of-life/end-of-support risks, obsolete assets and other identified technology risks.
• Track approved risk acceptance periods, mitigating controls, monitoring requirements, expiry dates and remediation milestones.
• Monitor outstanding risk mitigation actions and escalate overdue or inadequately addressed risks to the Head of IT Compliance.
• Coordinate with IT system/risk owners, infrastructure, cybersecurity and other relevant stakeholders to obtain risk information and validate control evidence

IT Policies, Standards and Procedures

• Coordinate the development, review and updating of internal IT governance, information security, data privacy policies, standards and procedures.
• Maintain the policy inventory, review schedule, approval records and version history.
• Track implementation of approved policies and procedures and follow up on outstanding actions with the relevant policy and control owners

. IT Audit, Regulatory Assessments and Remediation

• Coordinate internal and external IT audits, regulatory assessments, bank/customer due diligence exercises and other compliance reviews.
• Prepare, consolidate and validate supporting documents and evidence in collaboration with relevant control owners
• Maintain an audit findings and corrective action register, including accountable owners, target dates, remediation status and closure evidence.
• Monitor remediation progress, challenge incomplete responses where necessary and escalate overdue or high-risk findings.
• Coordinate responses to audit queries and assessment questionnaires, ensuring consistency, accuracy and appropriate management review.

Governance reporting and performance monitoring

• Maintain IT compliance KPI/KRI registers, compliance dashboards, management reports and action trackers.
• Prepare periodic reports on compliance status, audit findings, risk exposure, overdue remediation, policy review status and key governance activities.
• Monitor completion of scheduled compliance activities and report exceptions, emerging issues and areas requiring management attention.
• Maintain supporting evidence and governance records for management reporting, audit and regulatory review.

Third-party, outsourcing and customer compliance

• Coordinate third-party IT risk assessments, due diligences from banks, and monitor the maintenance of vendor security and compliance documentation.
• Coordinate responses to bank and customer IT due diligence questionnaires, ensuring that responses are supported by appropriate evidence and reviewed by the relevant stakeholders.
• Track outstanding third-party security requirements, contractual obligations and remediation commitments.
• Support monitoring of applicable outsourcing, cloud governance, confidentiality and data protection requirements.

Information security, resilience and awareness governance

• Coordinate governance and compliance monitoring activities relating to information security, access management, change management, vulnerability and patch management, backup, disaster recovery and business continuity, as applicable.
• Obtain and review evidence from designated control owners and track identified gaps and remediation actions.
• Coordinate governance documentation and follow-up arising from disaster recovery exercises, business continuity exercises and cybersecurity tabletop exercises.
• Coordinate IT governance and compliance awareness activities, including training schedules, completion records and supporting evidence.
• Provide governance support for reported IT security incidents, policy violations and compliance exceptions, as required.

Minimum Qualifications & Experience :

• Bachelor’s degree in information technology, Computer Science, Information Security, Risk Management, or a related discipline.
• Professional certifications such as CISA, CRISC, CGEIT, ISO/IEC 27001 Lead Implementer/Auditor, CISSP, or equivalent will be an added advantage.
• Minimum 5 years of experience in IT Governance, IT Risk Management, Information Security, IT Audit, or Compliance.
• Experience in financial services, cash management, or highly regulated industries is preferred.
• Experience managing IT audits and regulatory compliance activities.
• Knowledge of governance frameworks such as RMIT, COBIT, ISO/IEC 27001, NIST, or ITIL is an advantage

Pay: RM6,000.00 - RM6,800.00 per month

Benefits:

• Cell phone reimbursement
• Dental insurance
• Flexible schedule
• Maternity leave
• Parental leave

Work Location: In person