IT GRC Analyst (SDE 2)

Kredivo Group; Daerah Khusus Ibukota Jakarta; On-site; IDR 407.564.000 - 652.104.000; Full time

Job summary

A leading fintech company in Jakarta is looking for an IT GRC Specialist to support governance, risk, and compliance functions. Responsibilities include managing access controls, conducting third-party security assessments, and supporting IT audit processes. Candidates should have experience with information security management and regulatory compliance. This role is crucial for maintaining robust security practices across the organization.

Qualifications

• Experience with access control management frameworks.
• Knowledge of ISO 27001 and regulatory compliance.
• Strong analytical and problem-solving skills.

Responsibilities

• Support oversight of user access management and security controls.
• Conduct third-party security assessments for vendor engagements.
• Assist in maintaining company-wide Information Security Compliance Program.

Skills

Information Security Management

Risk Assessment

Access Control

Compliance Standards

Incident Management

Job description

The IT GRC Specialist (SDE2) will be a contributing member of the IT Governance, Risk, and Compliance (GRC) team, providing essential support to various IT GRC functions across entities within the Kredivo Group. This role will primarily focus on assisting with access control management, supporting third-party security assessments, contributing to compliance initiatives, and aiding internal IT GRC operations. The specialist will help ensure foundational compliance, risk management, and governance practices are upheld within the organization's information systems and technology landscape.

About the job:

Access Control Management (50%):

• Support in the oversight and continuous improvement of information security controls related to user access management.
• Support efforts in ensuring appropriate access provisioning, least privilege enforcement, and periodic access reviews for internal and/or external tools
• Contribute to evaluating the effectiveness of security measures like configuration management practices in infra, network, endpoint, & cloud services in particular as they relate to access controls.

Third-Party Security Assessment (20%):

• Initiate, collect, & validate security review for new vendor engagements by sending TPSA (Third-Party Security Assessment) forms
• Coordinate with internal teams (InfoSec, Legal, Procurement) for review and input.
• Assess vendor responses to identify security and compliance risks.
• Classify risk levels (Low/Medium/High) and provide recommendations.
• Ensure vendor engagement meets company’s security and regulatory standards (e.g., ISO 27001, OJK, Bank Indonesia, other regulatory).
• Track and document the entire assessment process for audit and reporting purposes.
  Escalate high-risk findings and support follow-up with vendors.

IT Audit Support (30%):

• Contribute to maintaining and improving the company-wide Information Security Compliance Program by ensuring alignment with internal policies and applicable regulations.
• Assist in the creation, implementation, and maintenance of information security policies, procedures, and control practices to align with internal processes and regulatory requirements.
• Support strategies to handle increasing volumes of IT compliance assessments, including those related to ISO 27001, ITGC, OJK, and Bank Indonesia and other regulations.
• Collaborate for Information Security Awareness activity to ensure alignment of security awareness efforts with compliance requirements and contribute to tracking its effectiveness.

#LI-RR1