Security and Governance Specialist, Automation

Maybank; Kuala Lumpur; On-site; MYR 120,000 - 240,000; Full time

Job summary

Maybank in Malaysia seeks a Security and Governance Specialist, Automation, to embed security, risk, compliance, privacy, auditability and governance controls across the automation lifecycle. Translate control requirements into practical standards and assurance activities.

You will drive RBAC and least-privilege, coordinate threat/risk assessments, secure design reviews, and provide templates and training to engineering teams to ensure auditable, compliant automation across platforms.

Qualifications

• Bachelor degree in Cybersecurity, Information Technology, Risk, Engineering or related discipline.
• Typically 6+ years in technology security, risk, governance, compliance or audit within a large regulated enterprise.
• Experience with privileged access, RBAC, secure SDLC, change controls, cloud/infrastructure security and audit evidence.
• Ability to translate policies into implementable technical controls.
• CISSP, CISM, CRISC, CISA, ISO 27001, cloud-security or equivalent certifications are advantageous.

Responsibilities

• Embed security, risk, compliance, privacy, auditability and governance controls across the enterprise automation lifecycle.
• Translate control requirements into practical standards, evidence, access models and assurance activities without unnecessarily constraining delivery.
• Define automation control requirements, lifecycle checkpoints, evidence and ownership.
• Consistent and auditable governance across use cases.
• Govern RBAC, segregation of duties, privileged access, service accounts, credentials and recertification.
• Least-privilege access and controlled execution.
• Coordinate threat/risk assessments, secure design reviews, vulnerability findings and remediation.
• Security risks identified and treated before production.
• Maintain control mapping, exceptions, decisions, attestations and audit responses.
• Reliable evidence for risk, compliance and audit review.
• Provide practical patterns, templates and training to engineering and use-case owners.
• Controls are understood and applied consistently.

Skills

RBAC

Segregation of duties

Threat modeling

Risk assessment

Executive communication

Education

Bachelor degree in Cybersecurity, Information Technology, Risk, Engineering or related discipline

CISSP / CISM / CRISC / CISA / ISO 27001 or cloud-security certifications (advantageous)

Tools

AAP/Ansible

Git/CI/CD

APIs

Job description

ROLE FOCUSBuild and scale secure, governed and reusable automation capabilities across the bank, covering technology infrastructure, cloud, network, security, applications, service operations, resilience, data and suitable business processes.

Job Title

Security and Governance Specialist, Automation

Reporting To

Automation Platform Owner

Department

Hiring Phase

Year 2

Employment Type

Permanent / Full-time

Location

Malaysia / as assigned

1. Job Purpose

Embed security, risk, compliance, privacy, auditability and governance controls across the enterprise automation lifecycle. Translate control requirements into practical standards, evidence, access models and assurance activities without unnecessarily constraining delivery.

2. Principal Accountabilities

Accountability

Supporting Activities

Expected Outcomes

Control framework

Define automation control requirements, lifecycle checkpoints, evidence and ownership.

Consistent and auditable governance across use cases.

Identity and access

Govern RBAC, segregation of duties, privileged access, service accounts, credentials and recertification.

Least-privilege access and controlled execution.

Security assurance

Coordinate threat/risk assessments, secure design reviews, vulnerability findings and remediation.

Security risks identified and treated before production.

Compliance and audit evidence

Maintain control mapping, exceptions, decisions, attestations and audit responses.

Reliable evidence for risk, compliance and audit review.

Governance enablement

Provide practical patterns, templates and training to engineering and use-case owners.

Controls are understood and applied consistently.

3. Success Measures

Access, credential and segregation controls operate as designed.

Material findings are remediated within agreed timelines.

Audit and regulatory evidence is complete, traceable and readily retrievable.

Engineering teams adopt control templates with fewer late-stage issues.

4. Qualifications and Experience

Bachelor degree in Cybersecurity, Information Technology, Risk, Engineering or related discipline.

Typically 6+ years in technology security, risk, governance, compliance or audit within a large regulated enterprise.

Experience with privileged access, RBAC, secure SDLC, change controls, cloud/infrastructure security and audit evidence.

Ability to translate policies into implementable technical controls.

CISSP, CISM, CRISC, CISA, ISO 27001, cloud-security or equivalent certifications are advantageous.

5. Technical and Functional Competencies

Identity, RBAC, segregation of duties, service accounts, secrets and privileged-access management.

Secure automation lifecycle, code repositories, pipeline controls, approvals and evidence retention.

Threat modeling, vulnerability management, risk assessment and control testing.

Logging, audit trails, monitoring, data protection and incident-response integration.

Knowledge of AAP/Ansible, APIs, Git/CI/CD, infrastructure and cloud control models.

Enterprise mindset with strong accountability and delivery discipline.

Clear written and verbal communication, including executive and technical audiences.

Ability to challenge constructively, make evidence-based decisions and manage ambiguity.

Collaboration across business, technology, architecture, security, risk, operations and vendors.

Commitment to documentation, knowledge transfer and continuous