Senior TPRM & Cybersecurity Due Diligence Lead

OCBC Bank (Malaysia) Berhad; Malaysia; On-site; MYR 180,000 - 300,000; Full time

Benefits offered by this job

Flexible benefits

Learning opportunities

Wellbeing programs

Job summary

OCBC Bank (Malaysia) Berhad invites applications for AVP/Manager, Third-Party Due Diligence Specialist. The role leads risk-based due diligence for third-party arrangements with a focus on technology, information security, cybersecurity and operational resilience.

The position requires independent risk assessments, issue management and advisory support to ensure compliance with regulatory requirements and internal policies, with close collaboration with internal teams and external providers.

Qualifications

• Degree in Information Security, Cybersecurity, IT Risk or related field.
• 5–8 years of experience in TPRM, Technology Risk, Cybersecurity, IT audit, or due diligence.
• Comprehensive knowledge of BNM RMiT guidelines with practical TPRM experience.
• Knowledge of cybersecurity frameworks (ISO 27001, NIST CSF, MAS TRM) and data privacy laws.

Responsibilities

• Customise risk-based questionnaires to regulatory expectations.
• Conduct comprehensive due diligence focusing on information security, cybersecurity maturity and operational resilience.
• Evaluate vendor controls across domains including IT security, cloud and data protection.
• Identify control gaps and mitigation recommendations.
• Provide advisory support and track remediation actions.
• Prepare risk reports and dashboards for stakeholders.
• Collaborate with policy owners and second/third line assurance functions.

Skills

TPRM experience

Information security

Cybersecurity

Vendor due diligence

IT audit

Regulatory knowledge

Analytical skills

Stakeholder mgmt

Education

Degree in Information Security

Tools

SOC reports

ISO certifications

Power BI

Power Apps

VAPT tools

Job description

OCBC Bank (Malaysia) Berhad invites applications for AVP/Manager, Third-Party Due Diligence Specialist. The role leads risk-based due diligence for third-party arrangements with a focus on technology, information security, cybersecurity and operational resilience.

The position requires independent risk assessments, issue management and advisory support to ensure compliance with regulatory requirements and internal policies, with close collaboration with internal teams and external providers.