IT Security and Risk Compliance

Job Descriptions:

• Risk Assessments, Audit and Regulatory Management
• Facilitate Technology related audit engagements with internal auditor, statutory auditor and regulator, following up with relevant parties to ensure all issues identified are remediated.
• Drive annual IT risk and control self-assessment exercises according to MAS regulatory notices/guidelines, internal enterprise IT policies, and standards.
• Coordinate independent reviews of the entities’ compliance against various info sec and technology risk regulations such as MAS TRM Guidelines, MAS 132 Notice on Cyber Hygiene and MAS 127 Notice on TRM for AIA Singapore, as well as Brunei technology risk regulations for AIA Brunei.
• Support in the divisions’ risk and controls assessment exercises, and quarterly internal controls for financial reporting controls assessments.
• Support the assurance initiatives under the First Line of Defense to uplift the technology and cyber controls' landscape for the Company.
• Information Security & Technology Risk Metrics
• Support the alignment of various information security and technology risk metrics for management reporting and issue.
• Review and assess collated metrics and material for consistency checks and trends.
• Policy, Standards and Exception Management
• Communicate material changes to internal policies/standards to partners. Facilitate risk evaluations and exception handling to deviations from the policies, standards and regulatory requirements.
• Risk & Compliance Initiatives
• Assist in enterprise-wide risk and compliance coordination for Technology division, where applicable.

REQUIREMENTS:

• 5 - 6 years of relevant work experience, including at least 3 years in IT audit, risk management, compliance and/or governance roles, with particular expertise and knowledge of governance reporting of technology risk issues and cybersecurity.
• Rich working experience from financial industry, big tech firms or established auditing firms will be considered favorably.
• Experience and exposure in info sec standards such as ISO27001, SOC2 or PCIDSS will be an advantage.
• Preferably a holder of one or more of the following information security and audit qualifications: Security+, CEH
• Candidates with advanced level qualifications such as CISSP, CISA, CRISC, CCSP will have added advantage