Principal ITGRC Program Manager (SDE 4)

Job description

Kredivo Group runs financial services businesses across seven entities in Indonesia, Vietnam, Thailand and the Philippines. Each entity has an ITGRC lead who manages local compliance, regulators and audits. This role works across those leads and responsible to program manage IT compliance for the whole Group: one set of policies implemented properly everywhere, one audit issue board, the same core processes in every entity, and audit findings and investor requirements driven through to closure. About the Job: 1. Group policies and their implementation Own the Group’s IT and information security policies and procedures. Keep them current and aligned with local regulatory requirements. Work with each entity’s ITGRC lead to make sure policies are implemented properly, not just adopted on paper. Check implementation regularly, for example through periodic reviews or evidence checks. Log gaps on the audit issue board and track them to closure with the entity lead. 2. Audit issue board Own the Group’s audit issue board. It covers findings from all audit types: financial audits, regulatory audits, ISO 27001 audits and partner security reviews. Drive every issue to closure across all entities, with Indonesia as the priority. Agree owners and due dates with entity leads, chase progress, and escalate when issues slip. Report open and overdue issues to leadership regularly, by entity and by audit type. 3. IT audits within financial audits Manage the IT audit workstream (ITGC) of the annual financial audits in Indonesia (Deloitte), Vietnam, Thailand and the Philippines. Plan with external auditors, entity ITGRC leads and internal stakeholders, coordinate evidence from IT and Engineering, and keep to timelines. 4. GRC platform and compliance processes Own the Group’s GRC platform, which we may build in-house or use off the shelf. Act as its product owner: define requirements, prioritise features, and drive adoption with entity leads. Make sure core processes run the same way in every entity: vendor security assessments, access reviews, and security awareness. 5. Investor requirements Track and manage information security requirements from investors such as Mizuho. Prepare responses and evidence with entity leads, and make sure commitments made to investors are delivered. About you: 7–10 years in IT audit, IT GRC or IT compliance. Big 4 experience is a strong plus. Hands-on experience with ITGC audits as part of financial statement audits. Exposure to regulatory audits, ISO 27001 audits or third-party security reviews. Working knowledge of ISO 27001 and common control frameworks (e.g. NIST CSF, COBIT). Experience running an audit issue tracker or GRC tool across multiple teams or entities. Excellent written and spoken English. Strong stakeholder management with peers and senior leadership. You can get policies implemented and findings closed through people you don’t manage. Comfortable having difficult conversations under pressure, such as pushing back on overdue findings, escalating risk to senior leaders, or handling auditor and investor scrutiny. Comfort working across countries and time zones. Nice to have: CISA, CRISC or CISSP Experience with Southeast Asian financial regulators (e.g. OJK, BI). Experience defining requirements for an internal tool or working with a GRC platform such as OneTrust. Experience handling investor or bank due diligence on security. #LI-RR1