Security Assurance & Reverse TPSA , Manager

Software International Corporation (M) Sdn Bhd; Kuala Lumpur; On-site; MYR 140,000 - 230,000; Full time

Job summary

Software International Corporation (M) Sdn Bhd is seeking a Security Assurance & Reverse TPSA Manager to lead client Third-Party Security Assessments, coordinate due diligence requests, and articulate the company’s security posture to stakeholders. The role requires strong governance, risk management, and regulatory knowledge, with a focus on ISO 27001 and NIST CSF.

Responsibilities include overseeing evidence management, responding to client inquiries, and driving improvements in security

Qualifications

• Bachelor's degree in a relevant field.
• 5-8 years of experience in information security, governance, assurance, IT audit, and third-party risk management.
• Knowledge of ISO 27001, NIST CSF, SOC reports, CIS controls, and PDPA Malaysia.

Responsibilities

• Lead and manage end-to-end client TPSA activities.
• Coordinate security due diligence requests from clients and prospects.
• Review and complete security questionnaires covering cybersecurity, cloud security, data protection, resilience, and compliance.
• Ensure responses are accurate, evidence-based, and aligned with security standards.
• Track TPSA requests and ensure timely completion within SLAs.
• Represent the company’s cybersecurity posture during client engagements.
• Explain controls to non-technical stakeholders and coordinate with SMEs.
• Measure TPSA performance and drive process improvements.
• Develop evidence packages and maintain regulatory documentation.

Skills

Information Security

Security Governance

Security Assurance

IT Audit

Third-Party Risk Management

Education

Bachelor's Degree in Information Security, Cybersecurity, Information Technology, Risk Management, Computer Science, or a related discipline

Job description

Security Assurance & Reverse TPSA , Manager

The Reverse TPSA Manager is responsible for managing and coordinating security, technology risk,

privacy, and compliance assessments conducted by company’s clients, brokers, consultants, and

prospective customers.

The role serves as the central point of contact for all client security due diligence activities, ensuring

timely and accurate responses to Third-Party Security Assessments (TPSAs), Requests for Security

Information (RFSIs), client audits, and cybersecurity questionnaires. The individual will work closely

with Information Security, Technology, Risk Management, Legal, Compliance, Privacy, Procurement,

and Business Units to articulate company’s security posture and control environment while

protecting confidential and proprietary information.

This role is critical in enabling business growth, strengthening client trust, and demonstrating

company's commitment to cybersecurity, operational resilience, and regulatory compliance.

Key Responsibilities

Reverse TPSA Management

• Lead and manage end-to-end client Third-Party Security Assessment (TPSA) activities.
• Serve as the primary coordinator for security due diligence requests from Corporate Solutions clients and prospective customers.
• Review, assess, and complete security questionnaires covering cybersecurity, cloud security, data protection, operational resilience, business continuity, and regulatory compliance.
• Ensure responses are accurate, consistent, evidence-based, and aligned with company’s security standards.
• Track TPSA requests and ensure completion within agreed timelines and service levels.

Client Security Assurance

• Represent company's cybersecurity and technology risk control environment during client due diligence engagements.
• Support client discussions, workshops, and security review meetings.
• Explain technical controls and security practices in clear business language suitable for nontechnical stakeholders.
• Address security concerns raised by clients and coordinate responses with relevant subject matter experts.

Stakeholder Management

• Collaborate with:
• Information Security
• Data Privacy Office
• Compliance
• Operational Risk
• Corporate Solutions Business
• Third-Party Risk Management Teams
• Coordinate collection of evidence and validation of control effectiveness.
• Escalate complex security or compliance issues where required.

Documentation & Evidence Management

• Maintain a centralized repository of:
• Standard TPSA responses
• Security evidence packages
• Regulatory and compliance documentation
• Frequently requested client artifacts
• Security certifications and attestations
• Ensure all externally shared information complies with company's information classification and disclosure requirements.
• Conduct periodic reviews of security response libraries to maintain accuracy and relevance.

Regulatory & Compliance Support

• Support responses related to:
• BNM Risk Management in Technology (RMiT)
• ISO 27001
• NIST Cybersecurity Framework
• Company Group Security Standards
• Operational Resilience requirements

Develop and maintain TPSA performance metrics and reporting dashboards.

Monitor trends in client security requirements and emerging cybersecurity expectations.

Identify recurring assessment themes and recommend process improvements.

Improve automation, standardization, and efficiency of security assessment responses.

Required Qualifications

• Bachelor's Degree in Information Security, Cybersecurity, Information Technology, Risk Management, Computer Science, or a related discipline.
• Minimum 5-8 years of experience in:
• Information Security
• Security Governance
• Security Assurance
• IT Audit
• Third-Party Risk Management

Required Knowledge & Skills

Cybersecurity & Risk Knowledge

• Strong understanding of:
• Information Security Governance
• Cybersecurity Risk Management
• Cloud Security Controls
• Identity & Access Management
• Vulnerability Management
• Data Protection and Privacy Controls
• Business Continuity and Disaster Recovery

Frameworks & Regulations

• Knowledge of:
• ISO 27001
• NIST Cybersecurity Framework
• SOC Reports
• CIS Controls
• BNM RMiT
• PDPA Malaysia
• Operational Resilience principles

Communication & Stakeholder Management

• Excellent written communication and documentation skills.
• Ability to respond to detailed client security questionnaires.
• Strong stakeholder engagement and influencing capabilities.
• Ability to translate technical controls into concise business-friendly responses.
• Strong presentation and facilitation skills.

Analytical Skills

• Strong problem-solving and critical-thinking capabilities.
• Ability to assess client requirements and map them to existing controls.
• Ability to identify gaps, risks, and potential remediation actions.

Preferred Qualifications

• Professional certifications such as:
• CISSP
• CISM
• CRISC
• CISA
• CCSP
• Experience in:
• Insurance industry