Kredivo Group runs financial services businesses across seven entities in Indonesia, Vietnam, Thailand and the Philippines. Each entity has an ITGRC lead who manages local compliance, regulators and audits. This role works across those leads and responsible to program manage IT compliance for the whole Group: one set of policies implemented properly everywhere, one audit issue board, the same core processes in every entity, and audit findings and investor requirements driven through to closure.
About the Job:
1. Group policies and their implementation
Own the Group’s IT and information security policies and procedures. Keep them current and aligned with local regulatory requirements.
Work with each entity’s ITGRC lead to make sure policies are implemented properly, not just adopted on paper.
Check implementation regularly, for example through periodic reviews or evidence checks. Log gaps on the audit issue board and track them to closure with the entity lead.
2. Audit issue board
Own the Group’s audit issue board. It covers findings from all audit types: financial audits, regulatory audits, ISO 27001 audits and partner security reviews.
Drive every issue to closure across all entities, with Indonesia as the priority. Agree owners and due dates with entity leads, chase progress, and escalate when issues slip.
Report open and overdue issues to leadership regularly, by entity and by audit type.
3. IT audits within financial audits
Manage the IT audit workstream (ITGC) of the annual financial audits in Indonesia (Deloitte), Vietnam, Thailand and the Philippines.
Plan with external auditors, entity ITGRC leads and internal stakeholders, coordinate evidence from IT and Engineering, and keep to timelines.
4. GRC platform and compliance processes
Own the Group’s GRC platform, which we may build in-house or use off the shelf. Act as its product owner: define requirements, prioritise features, and drive adoption with entity leads.
Make sure core processes run the same way in every entity: vendor security assessments, access reviews, and security awareness.
5. Investor requirements
Track and manage information security requirements from investors such as Mizuho.
Prepare responses and evidence with entity leads, and make sure commitments made to investors are delivered.
About you:
- 7–10 years in IT audit, IT GRC or IT compliance. Big 4 experience is a strong plus.
- Hands-on experience with ITGC audits as part of financial statement audits.
- Exposure to regulatory audits, ISO 27001 audits or third-party security reviews.
- Working knowledge of ISO 27001 and common control frameworks (e.g. NIST CSF, COBIT).
- Experience running an audit issue tracker or GRC tool across multiple teams or entities.
- Excellent written and spoken English.
- Strong stakeholder management with peers and senior leadership. You can get policies implemented and findings closed through people you don’t manage.
- Comfortable having difficult conversations under pressure, such as pushing back on overdue findings, escalating risk to senior leaders, or handling auditor and investor scrutiny.
- Comfort working across countries and time zones.
Nice to have:
- CISA, CRISC or CISSP
- Experience with Southeast Asian financial regulators (e.g. OJK, BI).
- Experience defining requirements for an internal tool or working with a GRC platform such as OneTrust.
- Experience handling investor or bank due diligence on security.
#LI-RR1
Skills Required
- 7-10 years of experience in IT audit, IT GRC, or IT compliance
- Hands-on experience with ITGC audits as part of financial statement audits
- Exposure to regulatory audits, ISO 27001 audits, or third-party security reviews
- Working knowledge of ISO 27001 and common control frameworks such as NIST CSF and COBIT
- Experience managing an audit issue tracker or GRC tool across multiple teams or entities
- Excellent written and spoken English
- Strong stakeholder management with peers and senior leadership
- Ability to drive policy implementation and finding closure through people without direct management authority
- Comfort handling difficult conversations, escalating risk, and managing auditor and investor scrutiny
- Ability to work across countries and time zones
- CISA, CRISC, or CISSP certification
- Experience with Southeast Asian financial regulators, such as OJK or BI
- Experience defining requirements for an internal tool or working with a GRC platform such as OneTrust
- Experience handling investor or bank security due diligence
- Big Four experience
What We Do
Kredivo Group is Southeast Asia’s leading provider of digital financial services through its brands Kredivo, KrediFazz and Krom. Kredivo is the leading digital credit platform in Indonesia and Vietnam that gives customers instant credit financing for ecommerce and offline purchases, and personal loans, based on real-time decisioning. Kredivo users can buy now and pay later across the entirety of Indonesia’s retail commerce network with one of the lowest interest rates amongst digital credit providers in the country. Krom Bank Indonesia (formerly known as Bank Bisnis Internasional, IDX: BBSI) is the group’s bank entity and the operator of the Indonesian neobank Krom. Kredivo Group is backed by leading financial and strategic investors such as Mizuho Financial Group, Square Peg Capital, Jungle Ventures, Naver Corp, Mirae Asset, Telkom Indonesia and Victory Park Capital among others
.jpg)
.png){kind=logo}
