Principal ITGRC Program Manager (SDE 4)

Kredivo Group; Jakarta Pusat; Sur place; IDR 350 000 000 - 700 000 000; Plein temps

Résumé du poste

Kredivo Group is seeking a senior IT GRC professional to own the Group’s IT and information security policies, coordinate across Indonesia, Vietnam, Thailand and the Philippines, and drive audits from planning to closure.

You will lead the audit issue board, manage ITGC work within financial audits, guide the GRC platform adoption, and ensure investor and regulator requirements are addressed across all entities.

Qualifications

• 7–10 years in IT audit, IT GRC or IT compliance.
• Big 4 experience is a strong plus.
• Hands-on with ITGC audits within financial statement audits.
• Exposure to ISO 27001, NIST CSF or COBIT.
• Experience running an audit issue tracker or GRC tool.
• Excellent written and spoken English.

Responsabilités

• Own the Group’s IT and information security policies and procedures; ensure they are current and properly implemented across all entities.
• Own and operate the Audit Issue Board; drive issues to closure across all entities with Indonesia as a priority.
• Manage the ITGC audits within the annual financial audits across multiple countries.
• Own the Group’s GRC platform; define requirements, prioritise features, drive adoption group-wide.
• Track and respond to investor requirements with entity leads and ensure commitments are delivered.

Connaissances

IT GRC

IT Audit

Stakeholder Management

English Proficiency

Regulatory Audits

Outils

GRC tool

OneTrust

Audit tracker

Description du poste

Kredivo Group runs financial services businesses across seven entities in Indonesia, Vietnam, Thailand and the Philippines. Each entity has an ITGRC lead who manages local compliance, regulators and audits. This role works across those leads and responsible to program manage IT compliance for the whole Group: one set of policies implemented properly everywhere, one audit issue board, the same core processes in every entity, and audit findings and investor requirements driven through to closure.

About the Job:

1. Group policies and their implementation

Own the Group’s IT and information security policies and procedures. Keep them current and aligned with local regulatory requirements.
Work with each entity’s ITGRC lead to make sure policies are implemented properly, not just adopted on paper.
Check implementation regularly, for example through periodic reviews or evidence checks. Log gaps on the audit issue board and track them to closure with the entity lead.

2. Audit issue board

Own the Group’s audit issue board. It covers findings from all audit types: financial audits, regulatory audits, ISO 27001 audits and partner security reviews.
Drive every issue to closure across all entities, with Indonesia as the priority. Agree owners and due dates with entity leads, chase progress, and elevate when issues slip.
Report open and overdue issues to leadership regularly, by entity and by audit type.

3. IT audits within financial audits

Manage the IT audit workstream (ITGC) of the annual financial audits in Indonesia (Deloitte), Vietnam, Thailand and the Philippines.
Plan with external auditors, entity ITGRC leads and internal stakeholders, coordinate evidence from IT and Engineering, and keep to timelines.

4. GRC platform and compliance processes

Own the Group’s GRC platform, which we may build in-house or use off the shelf. Act as its product owner: define requirements, prioritise features, and drive adoption with entity leads.
Make sure core processes run the same way in every entity: vendor security assessments, access reviews, and security awareness.

5. Investor requirements

Track and manage information security requirements from investors such as Mizuho.
Prepare responses and evidence with entity leads, and make sure commitments made to investors are delivered.

About you:

• 7-10 years in IT audit, IT GRC or IT compliance. Big 4 experience is a strong plus.
• Hands-on experience with ITGC audits as part of financial statement audits.
• Exposure to regulatory audits, ISO 27001 audits or third-party security reviews.
• Working knowledge of ISO 27001 and common control frameworks (e.g. NIST CSF, COBIT).
• Experience running an audit issue tracker or GRC tool across multiple teams or entities.
• Excellent written and spoken English.
• Strong stakeholder management with peers and senior leadership. You can get policies implemented and findings closed through people you don’t manage.
• Comfortable having difficult conversations under pressure, such as pushing back on overdue findings, escalating risk to senior leaders, or handling auditor and investor scrutiny.
• Comfort working across countries and time zones.

Nice to have:

• CISA, CRISC or CISSP
• Experience with Southeast Asian financial regulators (e.g. OJK, BI).
• Experience defining requirements for an internal tool or working with a GRC platform such as OneTrust.
• Experience handling investor or bank due diligence on security.
• #LI-RR1