IT Security & Risk Governance Leader

Eastspring Investments; Kuala Lumpur; On-site; MYR 180,000 - 260,000; Full time

Job summary

Eastspring Investments is seeking a senior IT security governance lead to develop and implement the local IT security programme, aligned with Group requirements and regulatory expectations. You will drive risk assessments, policy reviews and oversight of security controls across applications and infrastructure.

Responsibilities include governance oversight, vulnerability management, and third‑party security, with reporting to senior leadership and collaboration with cross‑functional teams to

Qualifications

• 8–12 years of relevant experience across information security, technology risk, IT audit, IT governance or regulatory compliance.
• Experience in financial services, asset management, banking, insurance or other regulated industries is strongly preferred.
• Certifications such as CISM, CISSP, CRISC or CISA are preferred; COBIT/ISO/IEC 27001 credentials are advantageous.

Responsibilities

• Lead IT Security Governance, Programme Leadership and multi-year security roadmaps aligned with Group requirements.
• Coordinate implementation of information security policies, standards and controls.
• Oversee technology risk assessments, control design reviews and risk treatment planning.
• Manage vulnerability/patch governance, incident governance and crisis response activities.
• Coordinate third‑party security oversight, vendor risk assessments and outsourcing controls.
• Prepare governance reporting for senior forums and maintain evidence repositories.

Skills

IT governance

Risk management

Stakeholder management

Cybersecurity risk assessment

Audit & compliance coordination

Governance reporting

Policy development

Team leadership

Education

Bachelor’s degree in Information Security/CS/IT

Job description

Eastspring Investments is seeking a senior IT security governance lead to develop and implement the local IT security programme, aligned with Group requirements and regulatory expectations. You will drive risk assessments, policy reviews and oversight of security controls across applications and infrastructure.

Responsibilities include governance oversight, vulnerability management, and third‑party security, with reporting to senior leadership and collaboration with cross‑functional teams to