Want to know if this job is worth applying to?
Kuala Lumpur, Malaysia
Onsite
Eastspring is a global asset manager with Asia at its core. We create a culture in which diversity is celebrated and inclusion assured, for our colleagues, customers, and partners. We provide a platform for our people to do their best work and make an impact to the business, and in exchange, we support our people's career ambitions. We pledge to make Eastspring a place where you can Connect, Grow and Succeed.
.
.
Key Responsibilities
A. IT Security Governance and Programme Leadership
• Develop, maintain and execute the local IT Security Programme and multi-year security roadmap, aligned with Group requirements, regulatory expectations and business priorities.
• Coordinate implementation of Group information security policies, standards, minimum controls and security initiatives.
• Lead requirements definition, solution and control design reviews, implementation oversight and security governance forums.
• Assess control effectiveness, identify systemic weaknesses, prioritise remediation and promote cybersecurity awareness across stakeholders.
• Maintain the IT governance framework, document repository, policy inventory, review calendar, ownership records, approval evidence, version control and retention records.
B. Technology Risk and Control Management
• Lead technology and application risk assessments for applications, projects, infrastructure changes and third-party services.
• Evaluate inherent risk, control design, residual risk, compensating controls and risk treatment plans, and provide practical advice to system owners and project teams.
• Own the Technology Risk Register, Department Risk Register, control inventory, KCSA records, risk acceptance records, review dates, dependencies and Key Risk Indicators.
• Coordinate submissions from control owners, verify completeness and internal consistency, and escalate missing evidence, overdue treatment actions and material changes.
• Facilitate risk identification, formal acceptance, treatment monitoring and closure validation.
C. Cybersecurity Operations Governance
• Govern vulnerability management, patch management and security remediation across infrastructure and applications.
• Review vulnerability exposure, patch compliance, BISO dashboards, security metrics and related management information.
• Coordinate penetration testing, application security assessments, secure-development control reviews and remediation validation.
• Coordinate firewall-rule reviews, DLP control reviews, web-defacement monitoring and threat-intelligence escalations.
• Maintain evidence for security operations reviews, attestations, risk acceptance and remediation closure.
D. Identity and Access Management Governance
• Oversee periodic user-access reviews, privileged-account reviews, access certifications and compliance attestations.
• Govern IAM platforms, CyberArk privileged identities, Kbolt reconciliations, segregation-of-duty concerns, privileged-ID compliance and application access controls.
• Ensure the completeness and accuracy of IAM feed files, reconciliation records and application access data.
• Oversee locally administered access to banking and business platforms, including exceptions and overdue remediation.
E. Third-Party Security and Outsourcing Risk
• Lead third-party security oversight and technology vendor risk assessments for new and existing service providers.
• Review TISQ assessments, security questionnaires, Coupa CRA submissions and outsourced service-provider evidence.
• Track vendor remediation commitments, exceptions, reassessments and closure evidence in coordination with Group stakeholders.
• Advise business and technology owners on security and control risks arising from outsourcing and supplier arrangements.
F. Cyber Resilience, Incident Governance and Crisis Support
• Coordinate Business Impact Analysis, Disaster Recovery and Business Continuity Plan reviews.
• Plan and facilitate cyber drills, recovery testing and technology-resilience exercises, including post-exercise reviews and closure of improvement actions.
• Coordinate technology and cybersecurity incident classification, investigation, impact assessment, evidence collation, escalation and reporting.
• Support crisis-management activities, facilitate post-incident reviews and track corrective actions to closure.
G. Audit, Regulatory Review and Compliance
• Act as the primary IT focal point for internal audit, external audit, regulatory reviews and compliance assessments.
• Lead audit planning, request coordination, evidence collection, root-cause analysis, management responses and corrective action plans.
• Maintain the central audit request list, issue register, management action plan tracker and closure evidence repository.
• Perform quality reviews of evidence packs for traceability, completeness, consistency and approval; validate closure evidence and escalate overdue or high-risk actions.
• Lead gap assessments against applicable regulations, Group policies, standards and local procedures, and manage exceptions, dispensations, compensating controls, expiry dates and risk acceptance records.
• Maintain the compliance calendar, attestations, obligations register and evidence repository; monitor completion of mandatory activities and report exceptions.
H. Policy, Standards and Governance Documentation
• Lead the drafting, review, approval, publication and periodic refresh of technology policies, standards, procedures and control documents.
• Ensure documents remain current, approved, retrievable and aligned with Group and local requirements.
• Maintain formal operating procedures, governance records, control inventories, decision records and retention evidence.
I. Management Reporting and Governance Forums
• Prepare security, risk, audit and compliance reporting for EXCO, GSC, RMC, ITMC and other relevant forums.
• Produce dashboards, risk maps, KRI reports, committee papers, escalation reports and decision materials using approved data sources.
• Coordinate agendas, papers, minutes, decisions and action logs, and drive timely follow-up of commitments.
• Analyse recurring issues, overdue actions, ageing items and documentation gaps; highlight trends and recommended management actions.
• Improve trackers, templates, data-quality checks and reporting processes to strengthen traceability and reduce manual effort.
J. Stakeholder Management and Team Leadership
• Partner with the Head of IT, Regional BISO, Group Information Security, Risk Management, Compliance, Internal Audit, business stakeholders, vendors and outsourced providers.
• Provide trusted advice on cybersecurity, governance, technology risk, audit, resilience and regulatory matters.
• Influence control owners and senior stakeholders to deliver remediation and meet governance commitments.
• Lead, coach and review the work of GSRC team members; allocate priorities, establish quality standards and build team capability.
• Maintain appropriate segregation between preparation, review, approval and closure validation activities.
Qualifications and Experience
Education
• Bachelor’s degree in Information Security, Computer Science, Information Technology, Information Systems, Risk Management, Business Administration or a related discipline.
Experience
• Typically 8 to 12 years of relevant experience across information security, technology risk, IT audit, IT governance or regulatory compliance, including experience leading workstreams or team members.
• Experience in financial services, asset management, banking, insurance or another regulated industry is strongly preferred.
• Demonstrated experience in risk assessments, audits, policy governance, IAM, vulnerability and patch governance, third-party security, cyber resilience, incident governance and remediation programmes.
• Practical experience maintaining registers, trackers, evidence repositories, committee materials and senior-management reporting.
• Experience working with outsourced technology providers, regional or Group security teams and matrix stakeholders.
Preferred Professional Certifications
• One or more relevant certifications such as CISM, CISSP, CRISC or CISA are preferred.
• Additional credentials such as COBIT Foundation, ISO/IEC 27001 Lead Implementer or Lead Auditor, ITIL Foundation, or equivalent governance, audit, risk or security qualifications are advantageous.
Eastspring is an equal opportunity employer. We provide equality of opportunity of benefits for all who apply and who perform work for our organisation irrespective of sex, race, age, ethnic origin, educational, social and cultural background, marital status, pregnancy and maternity, religion or belief, disability or part-time / fixed-term work, or any other status protected by applicable law. We encourage the same standards from our recruitment and third-party suppliers taking into account the context of grade, job and location. We also allow for reasonable adjustments to support people with individual physical or mental health requirements.
