It Grc - Digital Banking

Responsibilities :

● Lead the development and implementation of the system-wide risk management function of the information security program to ensure information security risks are identified and monitored.

● Internally assess, evaluate and make recommendations to management regarding the adequacy of the security controls for the company information and technology systems.

● Lead the system-wide information security compliance program, ensuring IT activities, processes, and procedures meet defined requirements, policies, and regulations.

● Develop and implement effective and reasonable policies and practices to secure protected and sensitive data and ensure information security and compliance with relevant legislation and legal interpretation.

● Execute strategy for dealing with the increasing number of audits, compliance checks, and external assessment processes for internal/external auditors, such as ISO 27001, ITGC, BI or OJK Regulations, etc.

● Work with Internal Audit/External Audit and outside consultants as appropriate on required security assessments and audits

● Coordinate and track all information technology and security-related audits including the scope of audits, timelines, auditing agencies, and outcomes. Work with auditors as appropriate to keep audit focus in scope, maintain excellent relationships with audit entities and provide a consistent perspective that continually puts the institution in its best light. Provide guidance and evaluation on audit responses.

Qualifications :

● 2-3 years of advanced IT skills with a high level of information security experience and expertise. ● Knowledge of information security risk management frameworks and compliance practices.

● Ability to develop security standards and guidelines based on best practices and industry standards.

● 1-2 years experience as Information Security, IT Governance, Risk and Compliance (IT GRC) or IT Auditors or IT Risk in Insurance or Financial Service industry.

● Excellent interpersonal, communication, and presentation skills, including formal report writing experience.

● Understanding of common security standards and regulations relating to technology and financial environment (e.g., BI or OJK Regulation, ISO 27001:2022, ITGC, etc.)

● Skills in documenting risk and compliance activities.

● Information security-related training or certifications such as ISO 27001 Auditor, CISSP, or CRISC. ● Experience performing information security audits or risk assessments.

● Familiarity with security auditing processes.