Security Governance Assistant Manager

Boost Holdings Sdn Bhd; Kuala Lumpur; On-site; MYR 150,000 - 210,000; Full time

Job summary

Boost Digital Bank seeks an experienced Security Governance Assistant Manager to advise on information security and regulatory matters, driving risk culture and owning policies and standards.

You will facilitate risk assessments, coordinate audits and regulatory engagements, and oversee governance across security domains including cloud, IAM, and vulnerability management. Strong communication and cross-functional collaboration are essential.

Qualifications

• Bachelor's degree in IT or related discipline.
• At least 5 years in IT with 2 years in Governance, Risk Management & Compliance, IT audit or risk management.
• Experience in financial/fintech with knowledge of RMiT.
• CISA, CRISC, CISM or CISSP qualifications are a plus.
• Knowledge of ISO 27001, NIST, CIS Controls and practical application.
• Experience developing information security policies and procedures.
• Experience facilitating audit engagements and management responses.
• Familiarity with cloud security, IAM, application security and vulnerability management.
• Strong analytical and documentation skills; ability to explain risk in business terms.
• Team-oriented and strong communication skills.

Responsibilities

• Provide consultation on information security policies and standards.
• Facilitate security risk and control assessments.
• Coordinate governance and audit/regulatory engagements.
• Track regulatory submissions and remediation status.
• Govern specialised security domains (cloud security, IAM, application security, vulnerability management).
• Prepare governance reporting and management papers.

Skills

Governance & Compliance

Information Security

Audit & Regulatory

Policy Development

Cross-functional Collaboration

Analytical Thinking

Communication Skills

Risk Management

Education

Bachelor's Degree in IT or related discipline

Tools

ISO 27001

NIST

CIS Controls

Job description

As the Security Governance Assistant Manager of Boost Digital Bank, your primary responsibility is to provide consultation and advisory on information security and key technology risk matters to build a strong information security risk culture within the organisation. This role owns the information security policies and standards, facilitates security risk and control assessments, and coordinates governance over specialised security domains. The role also coordinates regular security governance initiatives and manages related audit and regulatory engagements.

Security Policy, Standards and Framework

• Develop, maintain and periodically review internal procedures related to information security, ensuring alignment with internal standards and regulatory requirements such as BNM RMiT and industry standards such as ISO 27001 and NIST.
• Translate new and revised regulatory issuances and industry standards into security requirements, and drive their adoption across technology teams.
• Provide consultation and advisory to technology and business stakeholders on the application of security policies and standards to projects, systems and change initiatives.

Security Risk and Control Assessment

• Facilitate and manage cyber related risk and control assessment exercises based on regulatory requirements and internal standards.
• Conduct security risk assessments for new systems, services, third parties and material changes, documenting risks, controls and residual risk positions to support decision-making.
• Facilitate risk evaluations and exceptions handling deviations from requirements and standards, including compensating controls, approval, expiry tracking and periodic review.

Audit and Regulatory Engagement

• Facilitate and manage cyber and technology related audit engagements with internal audit, external audit and regulators, coordinating scope, walkthroughs, evidence submission and management responses.
• Coordinate regulatory submissions, self-assessments and thematic reviews relating to information security and cyber resilience.
• Track closure of security related audit, regulatory and assessment findings, validating remediation evidence before closure and escalating overdue items.

Governance of Specialised Security Domains

• Coordinate governance of specialised areas under information security such as cloud security, identity and access management, application security, data protection and vulnerability management.
• Review control gaps arising from penetration testing, vulnerability assessments and other security testing, and monitor remediation to closure.

Reporting, Metrics and Awareness

• Support alignment of various information security and technology metrics and key risk indicators for management reporting and escalation.
• Prepare security governance reporting and papers for management and the relevant governance forums, covering risks, findings, exceptions and remediation status.

Job Requirements & Criteria:

• Bachelor's Degree in Information Technology (IT), Computer Science or other related discipline
• At least 5 years of working experience with 2 years of experience in Governance, Risk Management & Compliance, IT audit or risk management
• Possess working experience in financial industry/fintech with strong understanding of regulatory and compliance requirements (e.g. RMiT)
• Related qualifications such as CISA, CRISC, CISM or CISSP is a high advantage
• Working knowledge of information security standards and frameworks such as ISO 27001, NIST and CIS Controls, and their practical application
• Experience developing and maintaining information security policies, standards and procedures
• Experience facilitating audit and regulatory engagements, including evidence coordination and management responses
• Familiarity with specialised security domains such as cloud security, identity and access management, application security and vulnerability management
• Strong analytical and documentation skills, with the ability to articulate security risk and control positions in business terms
• Ability to work collaboratively in cross-functional teams
• Strong communication and interpersonal skills