Senior Third-Party Risk & Tech Due Diligence Lead

ocbc; Kampung Teluk Menara; On-site; MYR 180,000 - 240,000; Full time

Job summary

OCBC Bank seeks an experienced risk professional to lead and execute risk-based due diligence for third-party tech service arrangements, focusing on information security, cybersecurity, and operational resilience. You will conduct independent risk assessments, manage issues, and advise to ensure compliance with regulatory requirements and internal policies.

The role requires collaboration with internal teams and external providers, preparing risk reports and dashboards for stakeholders.

Qualifications

• Degree in Information Security, Cybersecurity, Information Technology, Risk Management, or related field.
• 5-8 years in TPRM, Technology Risk, Cybersecurity, IT audit, or due diligence.
• Knowledge of BNM RMiT, PDPA, and outsourcing regulations.
• Experience reviewing vendor security questionnaires and SOC/ISO reports.

Responsibilities

• Customise risk-based questionnaires for regulatory alignment and evolving risk needs.
• Perform thorough due diligence including site visits and technology/cyber risk focus.
• Evaluate vendor controls across information security, cloud, data protection, and IT resilience.
• Identify gaps and provide remediation recommendations with timelines.
• Prepare risk reports and dashboards for stakeholders and management.
• Collaborate with policy owners and assurance functions across the Second/Third lines.
• Support Head of ORM with Central Bank, Internal Audit, and Compliance observations.

Skills

Analytical thinking

Risk judgement

Stakeholder management

Regulatory interpretation

Documentation discipline

Communication skills

Education

Degree in Information Security or related field

Tools

Microsoft 365

Power Platform

Power BI

Job description

OCBC Bank seeks an experienced risk professional to lead and execute risk-based due diligence for third-party tech service arrangements, focusing on information security, cybersecurity, and operational resilience. You will conduct independent risk assessments, manage issues, and advise to ensure compliance with regulatory requirements and internal policies.

The role requires collaboration with internal teams and external providers, preparing risk reports and dashboards for stakeholders.