IT GRC & Vendor Risk Analyst — Access & Audit Lead

Kredivo Group; Jakarta Pusat; On-site; IDR 300,000,000 - 600,000,000; Full time

Job summary

Kredivo Group seeks an IT GRC professional to manage vendor security assessments and user access reviews across all entities. You will support IT audits with evidence and follow-up, ensure contracts contain security terms, and help mature our continuous compliance efforts.

You will collaborate with senior team members, track findings, and drive remediation across multiple stakeholders, with English and Bahasa Indonesia proficiency.

Qualifications

• Bachelor's degree in IT, CS, Cybersecurity or related field.
• 3-5 years in IT GRC, IT audit or information security, preferably in financial services, fintech or banking.
• Hands-on experience with access reviews or third-party/vendor risk assessments.
• Understanding of security frameworks (ISO 27001, NIST CSF, COBIT) and local regulations (OJK, Bank Indonesia).
• Experience supporting audits: preparing evidence and responding to auditor requests.
• Organised and detail-oriented, able to run recurring processes across many stakeholders.
• Comfortable following up persistently with teams you don't manage.
• Good written and spoken English and Bahasa Indonesia.
• Nice to have: experience in IT audit, risk or compliance; CISA or ISO 27001 Lead Auditor; experience with GRC tools/workflow automation (Jira, n8n).

Responsibilities

• Run two core compliance processes: vendor security assessments and user access reviews, across all Group entities.
• Support IT audits with evidence and follow-up; work under guidance and grow ownership.
• Vendor security: run assessments, send questionnaires, collect evidence, review responses, flag risks.
• Ensure contracts include information security terms; keep vendor inventory and assessments up to date.
• Improve automation for vendor assessments.
• Access reviews: pull access lists, coordinate with system owners, track sign-off, ensure removals occur.
• Check that access provisioning/removal follows policy and least privilege; log exceptions and close them.
• Move access reviews toward continuous compliance as tooling matures.
• Audit/compliance support: prepare evidence for ITGC, ISO 27001, OJK, Bank Indonesia and partner security reviews.
• Track findings on audit board and follow up until closure.
• Support Security Awareness with compliance tracking.
• Report on processes: reviews completed, overdue items, and vendor risk ratings.

Education

Bachelor's degree in Information Technology, Computer Science, Cybersecurity or a related field

Tools

Jira

n8n

Job description

Kredivo Group seeks an IT GRC professional to manage vendor security assessments and user access reviews across all entities. You will support IT audits with evidence and follow-up, ensure contracts contain security terms, and help mature our continuous compliance efforts.

You will collaborate with senior team members, track findings, and drive remediation across multiple stakeholders, with English and Bahasa Indonesia proficiency.