APAC Technology GRC Manager

Chubb Insurance; Kuala Lumpur; On-site; MYR 120,000 - 160,000; Full time

Job summary

A multinational insurance company in Kuala Lumpur is seeking an experienced APAC Technology GRC Manager to oversee risk management and compliance in the Asia Pacific region. This role involves engaging with various IT stakeholders, managing risk frameworks, and reporting to senior management. Candidates should have a degree in a relevant field and significant experience in technology risk management. Strong analytical skills and the ability to influence change are essential for success in this dynamic environment.

Qualifications

• CISA, CISSP, CISM, or CRISC certification required or in progress.
• Minimum 8 years of Technology Risk Management experience.
• Experience in leading programmes to identify risk exposure.

Responsibilities

• Manage governance and management of risk and controls across APAC.
• Review global policies and standards with stakeholders.
• Prepare reports for senior management on technology and security controls.

Skills

Strong relationship-building skills

Knowledge of regulatory compliance requirements

Strong Excel and PowerPoint skills

Analytical and detail oriented

Education

Degree in Computer Science, Information Systems, or Engineering

Tools

Common IT technologies (OS, databases, network devices)

Job description

The APAC Technology GRC Manager will be part of the APAC GRC team. You will be responsible for managing the governance and management of risk and controls across the Asia Pacific region.

The role will be part of a broader team ambition which seeks to ensure APAC Technology comply with all their obligations. This position will require strong collaboration with members within the IT divisions and control functions across the organisation, along with the ability to influence change in a highly complex and matrixed environment.

Responsibilities

• Review global policies and standards with APAC Technology stakeholders, as well as provide consolidated feedback and/or clarification to policy owners.
• Collate and prepare reports to Chubb senior management regarding adherence to Chubb's minimum technology and security controls, IT risks, IT audit findings, and remediation plans.
• Drive the execution of Technology Risk Management framework, ensuring effective implementation of risk policies and procedures across regional technology functions.
• Prepare and develop technology risk insights (such as IT audit thematic and trend analysis) to be presented at APAC Technology Risk Management Committee.
• Improve the existing technology processes, risks and control taxonomies based on internal policies and standards, regional regulatory requirements, industry standards and best practices.
• Engage and collaborate with technology stakeholders to proactively identify risks at a detailed and technical level and ensure that IT is effectively driving remediation activities and continuously improving IT risk posture.
• Maintain and improve the issue register to ensure timely remediation of issues and meaningful reporting to management.
• Facilitate and manage stakeholder self-assessment initiatives to identify controls gaps.
• Facilitate the development and implementation of the Risk Appetite and Tolerance framework, working with senior leadership to define risk boundaries and embed them into decision‑making processes.
• Establish and monitor Key Risk Indicators (KRIs) to enable ongoing risk monitoring, trend analysis, and early detection of emerging risks across Business, Geographical and Corporate units.
• Gather and consolidate gaps identified and present to the management with a risk lens.
• Perform thematic review or risk assessment of areas requested by management.
• Accountable for managing regional internal and external reviews/audits from audit planning (such as request for information (RFI), opening meeting, etc.), fieldwork (such as RFI, issue discussion, etc.), to reporting and closing meeting.
• Responsible for monitoring and validating the closure of management actions arising from internal and external reviews/audits, including regulator inspection reviews.
• Approve major system enhancements from a risk and compliance perspective.
• Act as the ambassador of risk culture.

Qualifications

• CISA, CISSP, CISM, or CRISC (currently possess the certification or working towards completing the certification).
• A Degree in Computer Science, Information Systems, Engineering or equivalent work experience.
• Risk Management, Compliance or IT Audit experience.
• Minimum 8 years of Technology Risk Management experience in a large organisation, preferably in a multi‑national company.
• Strong relationship‑building skills with all layers of the organisation and the ability to influence and affect change with commercial acumen.
• Knowledge of regulatory compliance requirements across the region, as well as international standards such as PCI, SOX, ISO 27001, OWASP and NIST.
• Knowledge of common IT technologies (OS, databases, network devices, applications).
• Experience in leading programmes for proactively identifying risk exposure and potential non‑compliant areas.
• Superior verbal and written communication and presentation skills, strong interpersonal skills and the ability to work independently.
• Collaborative with the ability to influence without authority and have impact.
• Demonstrates sense of urgency, a high degree of initiative and professional judgment.
• Strong Excel and PowerPoint skills.
• Eager to learn new and varied systems.
• Service focused, analytical and detail oriented.