AVP: Third-Party Risk & Cybersecurity Due Diligence Lead

OCBC Group; Kuala Lumpur; Hybrid; MYR 150,000 - 260,000; Full time

Benefits offered by this job

Competitive base salary

Learning and development

Job summary

OCBC Malaysia is seeking an AVP/Manager to lead third-party due diligence focused on technology, cybersecurity and operational resilience. You will assess vendor controls, perform risk-based reviews, and collaborate with internal teams and external providers to ensure regulatory conformity and strong governance.

The role requires 5–8 years in TPRM or related fields, familiarity with BNM RMiT and PDPA, and the ability to translate complex findings into actionable remediation plans and clear

Qualifications

• Degree in Information Security, Cybersecurity, IT, Risk Management or related field.
• 5-8 years in TPRM, tech risk, cybersecurity, IT audit, or due diligence.
• Knowledge of BNM RMiT, PDPA, outsourcing regulations.
• Experience reviewing vendor security questionnaires, SOC reports, and ISO certifications.
• Hands-on experience with VAPT outputs to assess residual risk.

Responsibilities

• Customise risk questionnaires for regulatory alignment and evolving risk.
• Conduct comprehensive due diligence including site visits.
• Evaluate vendor controls across information security, cloud, IT resilience.
• Identify gaps and provide mitigation recommendations.
• Prepare risk reports and dashboards for stakeholders.
• Collaborate with policy owners and other assurance functions.

Skills

Analytical thinking

Risk assessment

Stakeholder management

Regulatory compliance

Documentation discipline

Communication skills

Attention to detail

Multi-tasking

Education

Degree in Information Security, Cybersecurity, IT, Risk Management or related field

Tools

Power BI

Microsoft 365

Power Apps

Power Platform

Job description

OCBC Malaysia is seeking an AVP/Manager to lead third-party due diligence focused on technology, cybersecurity and operational resilience. You will assess vendor controls, perform risk-based reviews, and collaborate with internal teams and external providers to ensure regulatory conformity and strong governance.

The role requires 5–8 years in TPRM or related fields, familiarity with BNM RMiT and PDPA, and the ability to translate complex findings into actionable remediation plans and clear