Security Governance, Consultant/Principal

AIA Hong Kong and Macau; Singapore; On-site; SGD 60,000 - 120,000; Full time

Job summary

An established industry player is seeking a Security Governance Consultant to lead initiatives in information security and risk management. This pivotal role involves overseeing security governance, managing technology risk metrics, and ensuring compliance with regulatory standards. The ideal candidate will have extensive experience in the financial sector, a strong understanding of security governance, and the ability to collaborate effectively with various stakeholders. Join this innovative firm and contribute to creating a healthier, more sustainable future through enhanced digital experiences that positively impact millions of lives.

Qualifications

• 8-15 years of IT experience in audit, risk management, compliance, and governance roles.
• Strong knowledge of KRIs and metrics development for security reporting.

Responsibilities

• Oversee security governance and provide consultation on information security.
• Manage third-party vendor security assessments and compliance.

Skills

Information Security

Risk Management

Compliance

Analytical Skills

Communication Skills

Problem-Solving

Education

University degree in Computer Science or related disciplines

Tools

eGRC

ISO27001

NIST standards

Job description

Security Governance, Consultant/Principal

Apply locations SG-Tampines Agency Building time type Full time posted on Posted 4 Days Ago job requisition id JR-55246

At AIA we’ve started an exciting movement to create a healthier, more sustainable future for everyone.

As pioneering innovators for over 100 years, we’re now transforming our organisation to be faster, simpler and more connected. Because we want to be even better equipped to develop digital solutions and experiences that help more people live Healthier, Longer, Better Lives.

To get there, we need people with tech/digital/analytics expertise and passion to help develop positive, sustainable change through digitally enhanced experiences that will impact the lives of millions of people and create a healthier future for everyone.

If you believe in developing a better tomorrow, read on.

About the Role

This position is responsible for overseeing the security governance domain, providing consultation, professional advice on information security and key technology risk matters relating to the mentioned geographical responsibilities, thereby adding value to building a strong information security risk culture centered on people, processes and technology. The role will require good understanding of security governance in the financial industry, technology risk management methodology and the ability to work cohesively with internal and external stakeholders to maintain the highest standard of security.

Information Security & Technology Risk Metrics Orchestration

1. Establish and lead the alignment of the Technology Key Risk Indicators (KRIs) for management reporting and escalation, including the reporting/escalation of outstanding or overdue action required.
2. Review and assess collated metrics and material for consistency checks and trends.
3. Oversee the Technology risk committee involving key technology management stakeholders as well as second line of defense.
4. Ensure proper documented post-meeting minutes and systematic follow-up for the committee and any related follow up discussions.

The first line of defense (1LOD) - Technology Risk Management

1. Close supervision on the monitoring and tracking of the end-to-end status of all the IT risk exceptions recorded in eGRC.
2. Collaborate with inter- and cross-functional teams to assess the risk impact of new initiatives and changes on the division risk profile.
3. Oversee the risk exceptions derived from Technology related audit engagement and ensure all issues are remediated.

Third-Party Security Risk Management

1. Manage the process of assessing and evaluating the security postures of third-party vendors and partners. This includes monitoring of third-party security assessment renewal, assigning the renewal reviews within the team and working closely with outsourced assessors on the status of TPSAs.
2. Perform due diligence and risk assessments on third-party vendors, ensuring their compliance with regulatory requirements as well as Group and Local policy and standards.

Governance Framework, Policy and Standards

1. Oversee the adherence of all security governance activities to regulatory requirements, compliance standards and Group policies.
2. Close collaboration with the security champions and communicate material changes to internal policies/standards to stakeholders.
3. Facilitate risk evaluations and exception handling to deviations from the policies, standards and regulatory requirements.

Specialized Areas Governance

1. The role may be called upon to lead or be involved in ensuring governance of specialized areas under information security, such as the governance of operations in the areas of IAM, cloud security, application security, etc.
2. Work closely with stakeholders including Technology risk management, Risk and Compliance, Legal, Business as well as other departments within Technology.

The role is an important support to the AD of Security Governance and is expected to perform the role of a mentor to the junior members of the staff within the department.

WHAT YOU SHOULD HAVE

1. University degree in one of the following or related disciplines (Computer Science, Computer Engineering, Information Systems, Cyber Security).
2. At least 8-15 years of IT experience, audit, risk management, compliance and governance roles, with good expertise and knowledge of governance reporting of technology risk issues and cyber security.
3. Rich working experience from financial industry is preferred.
4. Experience and exposure in MAS TRMG and relevant notices, information security standards such as ISO27001 and NIST standard will be an advantage.
5. Strong knowledge of KRIs and metrics development for security and risk management reporting.
6. Preferably a holder of one or more of the following information security and audit qualifications: CISSP, CISA, CRISC, CCSP.
7. Good Communication, Coordination and Interpersonal Skills.
8. Mature-thinking, meticulous, strong problem-solving and analytical traits.
9. High drive, energy and good attitude over teamwork.
10. Ability to work independently, with high levels of professional integrity.
11. Eagerness to learn and develop one’s knowledge in information security and risk management.

Build a career with us as we help our customers and the community live Healthier, Longer, Better Lives.

You must provide all requested information, including Personal Data, to be considered for this career opportunity. Failure to provide such information may influence the processing and outcome of your application. You are responsible for ensuring that the information you submit is accurate and up-to-date.