Principal ITGRC Program Manager (SDE 4)

Kredivo Group; Indonesia; Presencial; IDR 300.000.000 - 600.000.000; Jornada completa

Descripción de la vacante

Kredivo Group seeks an experienced IT Compliance Lead to drive the Group's ITGRC program across multiple entities in Indonesia and beyond. You will own policies, audits, and the GRC platform, coordinating with local ITGRC leads to ensure consistent implementation and timely closure of gaps.

Ideal candidates have 7–10 years in IT audit or IT compliance, hands-on ITGC experience, and strong English; familiarity with ISO 27001, NIST CSF or COBIT, and experience managing an audit issue tracker

Formación

• 7–10 years in IT audit, IT GRC or IT compliance.
• Hands-on experience with ITGC audits as part of financial statements audits.
• Exposure to regulatory ISO 27001 audits or third‑party security reviews.

Responsabilidades

• Own the Group's IT and information security policies and procedures; ensure implementation across all entities.
• Manage the Audit Issue Board and drive closure of findings across all entities, prioritising Indonesia.
• Plan and oversee ITGC audits within financial audits across Indonesia, Vietnam, Thailand and the Philippines.

Conocimientos

IT audit

IT GRC

IT compliance

Stakeholder management

Policy implementation

Audit issue tracker

English proficiency

Herramientas

GRC platform

OneTrust

ISO 27001

NIST CSF

COBIT

Descripción del empleo

Kredivo Group runs financial services businesses across seven entities in Indonesia, Vietnam, Thailand and the Philippines. Each entity has an ITGRC lead who manages local compliance, regulators and audits. This role works across those leads and responsible to program manage IT compliance for the whole Group: one set of policies implemented properly everywhere, one audit issue board, the same core processes in every entity, and audit findings and investor requirements driven through to closure.

About The Job

• Group policies and their implementation Own the Group's IT and information security policies and procedures. Keep them current and aligned with local regulatory requirements. Work with each entity's ITGRC lead to make sure policies are implemented properly, not just adopted on paper. Check implementation regularly, for example through periodic reviews or evidence checks. Log gaps on the audit issue board and track them to closure with the entity lead.
• Audit issue board Own the Group's audit issue board. It covers findings from all audit types: financial audits, regulatory audits, ISO 27001 audits and partner security reviews. Drive every issue to closure across all entities, with Indonesia as the priority. Agree owners and due dates with entity leads, chase progress, and elevate when issues slip. Report open and overdue issues to leadership regularly, by entity and by audit type.
• IT audits within financial audits Manage the IT audit workstream (ITGC) of the annual financial audits in Indonesia (Deloitte), Vietnam, Thailand and the Philippines. Plan with external auditors, entity ITGRC leads and internal stakeholders, coordinate evidence from IT and Engineering, and keep to timelines.
• GRC platform and compliance processes Own the Group's GRC platform, which we may build in-house or use off the shelf. Act as its product owner: define requirements, prioritise features, and drive adoption with entity leads. Make sure core processes run the same way in every entity: vendor security assessments, access reviews, and security awareness.
• Investor requirements Track and manage information security requirements from investors such as Mizuho. Prepare responses and evidence with entity leads, and make sure commitments made to investors are delivered.

About You

• 7–10 years in IT audit, IT GRC or IT compliance. Big 4 experience is a strong plus.
• Hands‑on experience with ITGC audits as part of financial statement audits.
• Exposure to regulatory audits, ISO 27001 audits or third‑party security reviews.
• Working knowledge of ISO 27001 and common control frameworks (e.g. NIST CSF, COBIT).
• Experience running an audit issue tracker or GRC tool across multiple teams or entities.
• Excellent written and spoken English.
• Strong stakeholder management with peers and senior leadership. You can get policies implemented and findings closed through people you don't manage.
• Comfortable having difficult conversations under pressure, such as pushing back on overdue findings, escalating risk to senior leaders, or handling auditor and investor scrutiny.
• Comfort working across countries and time zones.

Nice To Have

• CISA, CRISC or CISSP
• Experience with Southeast Asian financial regulators (e.g. OJK, BI).
• Experience defining requirements for an internal tool or working with a GRC platform such as OneTrust.
• Experience handling investor or bank due diligence on security.