IT Risk Manager

Privy; Jakarta Pusat; Presencial; IDR 600.000.000 - 1.000.000.000; Jornada completa

Descripción de la vacante

Privy is seeking an experienced IT Risk Leader to own risk methodologies, maintain an integrated risk register, and translate board-approved risk appetite into operating tolerances. You will drive BIA, TPRA, and risk reporting to the C-suite, across IT, operations, third-party, and privacy risks.

The role requires a 5–10 year background in IT risk, multiple frameworks (ISO 27001/22301, privacy standards), strong analytical skills, cross-functional collaboration, and a track record of

Formación

• Bachelor's degree required in IT, information systems, CS, business administration, risk management or related field.
• Certifications in risk management are preferred (CRISC, CISM, CGEIT, ISO 22301 Lead Implementer/Auditor, COSO ERM).
• 5-10 years of experience in IT risk management, enterprise risk management or GRC in regulated industries.

Responsabilidades

• Own IT risk methodology design, documentation, and maintenance.
• Maintain the integrated risk register across IT, operational, third-party and privacy risk.
• Translate board-approved risk appetite into operational tolerances and financial thresholds.
• Lead the Business Impact Analysis process end-to-end (BIA).
• Manage the Third-Party Risk Assessment (TPRA) programme and annual reassessments.
• Translate cyber risk inputs into risk register entries for executive reporting.
• Expand risk coverage to operational, strategic and supply chain risk.

Conocimientos

Analytical thinking

Systems thinking

Decision making

Communication skills

Cross-functional collaboration

Risk management

Educación

Bachelor's degree in IT / CS / Information Systems

Descripción del empleo

• Risk methodology ownership : Design, document, and own the IT risk assessment methodology, Build and maintain the impact and likelihood framework and ensure the methodology is documented and consistent
• Risk Register ownership : Maintain the single integrated risk register covering IT risk, operational risk, third-party risk, and privacy risk
• Translate board-approved risk appetite statements into operational tolerance ranges and financial thresholds per risk category
• Own the Business Impact Analysis process end-to-end
• Maintain the Dependency Register
• Design and operate the TPRA (Third-Party Risk Assessment) programme from questionnaire design, domain-weighted scoring, risk rating methodology (Low/Medium/High/Critical), compensating control requirements and maintain annual re-assessment schedule for vendor
• Receive cyber risk inputs from the CISO team monthly and translate technical cyber risk data into risk register entries or updates
• Expand risk methodology beyond IT risk to cover operational risk (process failure, human error, fraud), strategic risk (regulatory change, market shift), and supply chain risk at enterprise level

Job Qualifications :

• Bachelor's degree (S1) in Information Technology, Information Systems, Computer Science, Business Administration, Risk Management, or a related field
• Certifications (Preferred - At Least One of the Following Certifications): CRISC - Certified in Risk and Information Systems Control (ISACA), ISO 22301 Lead Implementer or Lead Auditor, CISM - Certified Information Security Manager (ISACA), CGEIT - Certified in the Governance of Enterprise IT (ISACA) atau COSO ERM Certification (AICPA).
• 5-10 years of experience in IT Risk Management, Enterprise Risk Management, Information Security Risk, or IT Governance, Risk, and Compliance (GRC), preferably in a regulated industry such as financial services, telecommunications, government, or a Trust Service Provider / Certification Authority (CA) environment.
• Demonstrated experience in designing, implementing, and managing risk assessment methodologies, Business Continuity Management Systems (BCMS), Business Impact Analysis (BIA), Third-Party Risk Assessment (TPRA), and risk reporting for C-suite executives.
• Proven experience operating in a multi-framework environment, managing and coordinating compliance requirements across ISO 27001, ISO 22301, privacy frameworks, and applicable industry-specific regulations simultaneously
• Strong analytical and systems thinking, confident decision-making, proactive risk identification, clear communication, and effective cross-functional collaboration to drive risk mitigation
• Strong knowledge of IT and enterprise risk management, including risk assessment and mitigation, ISO risk management and security standards, data privacy regulations, business continuity planning, business impact analysis, third-party risk assessment, AI governance, and WebTrust standards for Certification Authorities (CA)