About the role
You’ll run two of Kredivo Group’s core compliance processes day to day: vendor security assessments and user access reviews, across all Group entities. You’ll also support IT audits with evidence and follow-up. You’ll work under guidance from senior team members and take on more ownership as you grow.
About the job:
- Run two of Kredivo Group’s core compliance processes day to day: vendor security assessments and user access reviews, across all Group entities. You’ll also support IT audits with evidence and follow-up. You’ll work under guidance from senior team members and take on more ownership as you grow. - Vendor security: Run security assessments for new and existing technology vendors: send questionnaires, collect evidence, review responses, and flag risks. - Check that contracts with technology vendors include the required information security terms. - Keep the vendor inventory and assessment records up to date, and follow up on vendor remediation. - Use and improve the team’s existing automation for vendor assessments. - Access reviews: Run periodic user access reviews across systems and entities: pull access lists, send them to system owners, track sign-off, and make sure removals actually happen. - Check that access provisioning and removal follow policy and least privilege. - Log exceptions and track them to closure. - Help move access reviews to continuous compliance as our tooling matures. - Audit and compliance support: Prepare evidence for IT audits and assessments, such as ITGC, ISO 27001, OJK, Bank Indonesia and partner security reviews. - Track findings related to vendor security and access control on the audit issue board, and follow up with owners until they close. - Support the Security Awareness team with compliance tracking. - Report on your processes: reviews completed, overdue items, and vendor risk ratings.
About you:
- Bachelor’s degree in Information Technology, Computer Science, Cybersecurity or a related field. - 3- 5 years in IT GRC, IT audit or information security, preferably in financial services, fintech or banking. - Hands-on experience with access reviews or third-party/vendor risk assessments. - Understanding of security frameworks (e.g. ISO 27001, NIST CSF, COBIT) and local regulations such as OJK and Bank Indonesia. - Experience supporting audits: preparing evidence and responding to auditor requests. - Organised and detail-oriented, able to run recurring processes on time across many stakeholders. - Comfortable following up persistently with teams you don’t manage. - Good written and spoken English and Bahasa Indonesia. - Nice to have: Experience at a consulting or audit firm in IT audit, risk or compliance. CISA or ISO 27001 Lead Auditor, or working towards one. Experience with GRC tools or workflow automation (e.g. Jira, n8n).
#LI-RR1
Text as published by Kredivo Group. We don't edit postings; apply and ask questions on the employer's site.