Technology Risk Governance & Control, Principal

AIA Malaysia; Kampung Malaysia Tambahan; On-site; MYR 180,000 - 240,000; Full time

Job summary

AIA Malaysia is seeking a seasoned Technology and Cybersecurity Risk professional to strengthen governance, risk, and compliance across IT and cyber domains. The role emphasizes oversight of risk appetite, audits, and regulatory alignment within the Malaysian financial landscape.

The successful candidate will lead assessments, collaborate with governance forums, and ensure timely remediation of risk issues, with a strong emphasis on cloud and operational controls in a complex insurance

Qualifications

• Bachelor's degree in IT or related field (or equivalent).
• Minimum 8 years of experience in information and cybersecurity risk management.
• Industry certifications such as CISSP/CISA/CISM/CRISC/CGEIT are a plus.
• Solid understanding of IT and security operations, including cloud.
• Strong ability to synthesize diverse information into risk conclusions.

Responsibilities

• Assist in maintaining technology risk governance framework and certifications.
• Support regulatory compliance with Bank Negara Malaysia's policies.
• Develop and review IT and Cybersecurity Risk Appetite statements.
• Provide governance oversight for technology and cybersecurity risks.
• Coordinate Information Security Working Committee and governance forums.
• Lead control and risk assessments across technology domains.
• Document, track, and report risk assessment findings and actions.
• Prepare and report key risk metrics for management review.
• Support audits and regulatory compliance activities.
• Conduct third‑party security risk assessments and supply chain risk management.
• Track and close audit findings and monitor external threat intelligence.

Skills

Communication skills

Analytical mindset

Regulatory knowledge

Risk management

Interpersonal skills

Education

Bachelor's degree in IT/related field

Job description

Technology and Cybersecurity Risk Governance

• Assist in maintaining the technology risk governance framework and supporting the achievement of relevant certifications.
• Support compliance activities with Bank Negara Malaysia’s RMiT policy and other regulatory requirements.
• Contribute to the development and review of IT and Cybersecurity Risk Appetite statements and governance strategies.
• Provide governance and controls oversight for technology and cybersecurity issues and risks.
• Support the coordination of the Information Security Working Committee and related governance forums.

Technology and Cybersecurity Risk Management

• Lead and execute periodic control assessments and risk assessments, ensuring comprehensive coverage of all critical technology and cybersecurity domains.
• Document, track, and report on risk assessment findings, ensuring clear communication of risk exposure and recommended actions to relevant stakeholders.
• Act as the primary risk manager for open risk issues, ensuring all risk commitments are tracked, escalated where necessary, and remediated in a timely and effective manner by risk owners.
• Prepare and report key risk metrics for management review.
• Provide control assurance support, including facilitation of risk assessments, deviations, and mitigation plans.
• Assist with internal and external audits, including coordination of control assessments and regulatory compliance.
• Conduct third-party security risk assessments (TPSA) and support supply chain security risk management.
• Track and follow up on audit findings and ensure timely closure.
• Monitor external threat intelligence and elevate emerging risks as needed.

Information Technology and Cybersecurity Policies and Standards

• Assist in reviewing, maintaining, and publishing information security policies, standards, and procedures.
• Support the approval, training, and dissemination of security policies and practices.
• Monitor IT department compliance with cybersecurity policies and controls.
• Recommend updates to policies and procedures to enhance operational efficiency and regulatory alignment.

Cyber Training and Awareness

• Support the development and delivery of cybersecurity awareness programs.
• Assist in delivering targeted communication, training, and awareness initiatives for staff and management.
• Bachelor's degree (preferably in IT) in computer science, computer engineering, information systems, or a related study, or equivalent.
• Must have at least 8 years of relevant working experience in the managing of information and cyber security risks, FI-experienced preferable or enough work engagement in the Financial Industry.
• Industry-recognized professional information security certifications e.g. CISSP, CISA, CISM, CRISC, CGEIT is an added advantage.
• Solid understanding of operations and technology including Cloud.Direct and matured experience will be an added advantage.
• Good understanding of the insurance business domain and its critical success factors.
• Strong conceptual and analytical mindset supported by the ability to amass and integrate diverse information from various sources into technology and cybersecurity risk conclusions and recommendations.
• Strong sense of resourcefulness in sourcing data and meticulous in detail analysis besides the dexterity of learning and assimilating the multitude of disciplines in IT and Business functions.
• Ability to develop a comprehensive understanding of AIA’s business, market, industry and relate that knowledge to identified operations- and IT-related risks
• Knowledge necessary to propose relevant IT responses to changing business risks and regulatory changes
• Has in depth understanding of business risk, IT Governance, Enterprise Risk Management, Information security, and local regulatory compliance requirement.
• Must have experience with the engagement and interacting with the financial regulator (BNM).
• Results driven with strategic qualities.
• High degree of integrity, responsibility and ability to work with little supervision
• Key personal and job attributes for success: -
• Focus on quality – timeliness, accuracy, completeness amid tight timelines and balancing of simultaneous priorities
• Good command of documentary skills including policy design and risk identification, assessment and management.
• Strong communication and interpersonal skills completed by ability to engage business users in scoping requirements and with Group Office.
• Capacity to function under minimal supervision but optimal delivery