Manager - IT Risk and Compliance

Great Eastern; Kampung Malaysia Tambahan; On-site; MYR 120,000 - 200,000; Full time

Job summary

Great Eastern in Malaysia is seeking an IT Risk & Compliance professional to evaluate overall IT risk, maintain an active risk view, and report to Group IT management on a regular basis. You will implement the IT Compliance Programme, validate controls, monitor regulatory adherence, and drive remediation across GRM and RM&C.

The role requires a Bachelor's in IT/related field, 5+ years in technology risk or IT audit, and relevant certifications such as CISA/CISM/CRISC/CISSP.

Qualifications

• Bachelor's degree or higher in IT/related fields.
• 5+ years in technology risk, IT compliance, IT audit, or information security.
• Professional certifications such as CISA, CISM, CRISC, CISSP preferred.
• Knowledge of MAS TRM and RMiT requirements preferred.
• Experience in data analytics for risk & compliance.
• Insurance/financial services industry experience is advantageous.

Responsibilities

• Evaluate overall information technology risk and report to Group IT management.
• Implement and maintain the IT Compliance Programme to validate key IT controls.
• Monitor IT regulatory compliance and report gaps or breaches to management.
• Track changes in technology regulations and recommend remediation measures.
• Conduct compliance reviews of key IT processes and systems.
• Prepare compliance review reports and monitor remediation actions through to closure.
• Support consolidation and submission of Compliance Event Reporting to GRM and RM&C.
• Participate in technology risk assessments for AI, Cloud, and other technologies.
• Coordinate IT audit engagements and escalate overdue items.
• Promote IT risk awareness through awareness sessions and staff training.

Skills

Analytical

Stakeholder management

Communication

Data analytics

Problem solving

Risk awareness

Education

Bachelor's Degree in Information Technology or related

CISA, CISM, CRISC, CISSP

Job description

Integral role in IT Risk and Compliance team, responsible to evaluate overall information technology risk, maintain an active view, and report the overall risk & compliance posture to Group IT management on regular basis.

• Implement and maintain the IT Compliance Programme to provide assurance over Group IT's compliance status. This includes validating key IT controls based on annual prioritization using industry-accepted sampling methodologies. Reviews will cover relevant processes, systems, reports, and metrics.
• Monitor and assess IT compliance with regulatory requirements, internal policies, and standards, and report any compliance gaps or breaches to management.
• Track and evaluate changes in technology-related regulations and legislation that may impact Group IT's technology risk and compliance posture, and recommend appropriate remediation measures.
• Conduct compliance reviews of key IT processes and systems in accordance with the annual review plan, identifying gaps against regulatory, policy, and control requirements.
• Prepare timely compliance review reports, communicate findings to management, and monitor remediation actions through to closure.
• Support the consolidation and submission of Compliance Event Reporting from Group IT to Group Risk Management (GRM) and local Risk Management & Compliance (RM&C) teams.
• Support the review and assessment of Control Risk Self-Assessment (CRSA) activities in accordance with GRM and local RM&C requirements.
• Participate in technology risk assessments for emerging technology domains, including Artificial Intelligence (AI), Cloud Computing, and other new technologies.
• Support the management and oversight of Third-Party Risk Management (TPRM) processes for the GELM IT department.
• Prepare and maintain regular management reporting on IT compliance and technology risk matters.
• Coordinate IT audit engagements, including monitoring audit progress, tracking information requests, and escalating overdue items where necessary.
• Participate in root cause analysis activities for technology incidents and assist in identifying corrective and preventive actions.
• Conduct awareness sessions and promote staff understanding of IT risk, compliance requirements, and control responsibilities.
• Support the Department Risk Officer and Department Compliance Officer in executing risk and compliance governance responsibilities.
• Maintain the department's Risk Control Self-Assessment (RCSA) framework and perform control testing in accordance with GRM and local RM&C requirements.
• Review and assess various risk assessments, including Project Risk Assessments, General Purpose Risk Assessments, IT Risk Acceptance requests, and related technology risk documentation.

We are looking for people with

• Bachelor's Degree in Information Technology, Business Administration, Risk Management, Information Security, or a related discipline.
• Minimum 5 of relevant experience in Technology Risk, IT Compliance, IT Audit, Information Security, IT Governance, or Risk Management.
• Professional certifications such as CISA, CISM, CRISC, CISSP, or equivalent are preferred.
• Good understanding of MAS Technology Risk Management (TRM) Guidelines and BNM Risk Management in Technology (RMiT) requirements.
• Knowledge and hands-on experience in Risk and Control Self-Assessment (RCSA) methodologies, including control design and control effectiveness testing.
• Experience in data analytics and reporting, including the use of analytics tools to support risk and compliance monitoring.
• Strong analytical, problem-solving, and stakeholder management skills.
• Excellent communication, presentation, and report-writing skills.
• Experience in the insurance, banking, or financial services industry would be an advantage.

How you succeed

• Champion and embody our Core Values in everyday tasks and interactions.
• Demonstrate high level of integrity and accountability.
• Take initiative to drive improvements and embrace change.
• Take accountability of business and regulatory compliance risks, implementing measures to mitigate them effectively.
• Keep abreast with industry trends, regulatory compliance, and emerging threats and technologies to understand and highlight potential concerns/ risks to safeguard our company proactively.

Who we are

Founded in 1908, Great Eastern is a well-established market leader and trusted brand in Singapore and Malaysia. With over S$100 billion in assets and more than 16 million policyholders, including 12.5 million from government schemes, it provides insurance solutions to customers through three successful distribution channels – a tied agency force, bancassurance, and financial advisory firm Great Eastern Financial Advisers. The Group also operates in Indonesia and Brunei.

The Great Eastern Life Assurance Company Limited and Great Eastern General Insurance Limited have been assigned the financial strength and counterparty credit ratings of "AA-" by S&P Global Ratings since 2010, one of the highest among Asian life insurance companies. Great Eastern's asset management subsidiary, Lion Global Investors Limited, is one of the leading asset management companies in Southeast Asia.

Great Eastern is a subsidiary of OCBC, the longest established Singapore bank, formed in 1932. It is the second largest financial services group in Southeast Asia by assets and one of the world’s most highly-rated banks, with an Aa1 rating from Moody’s and AA- by both Fitch and S&P. Recognised for its financial strength and stability, OCBC is consistently ranked among the World’s Top 50 Safest Banks by Global Finance and has been named Best Managed Bank in Singapore by The Asian Banker.