About this role
You’ll run two of Kredivo Group’s core compliance processes day to day: vendor security assessments and user access reviews, across all Group entities. You’ll also support IT audits with evidence and follow-up. You’ll work under guidance from senior team members and take on more ownership as you grow.
About the job
- Run two of Kredivo Group’s core compliance processes day to day: vendor security assessments and user access reviews, across all Group entities. You’ll also support IT audits with evidence and follow-up. You’ll work under guidance from senior team members and take on more ownership as you grow.
- Vendor security: Run security assessments for new and existing technology vendors: send questionnaires, collect evidence, review responses, and flag risks.
- Check that contracts with technology vendors include the required information security terms.
- Keep the vendor inventory and assessment records up to date, and follow up on vendor remediation.
- Use and improve the team’s existing automation for vendor assessments.
- Access reviews: Run periodic user access reviews across systems and entities: pull access lists, send them to system owners, track sign-off, and make sure removals actually happen.
- Check that access provisioning and removal follow policy and least privilege.
- Log exceptions and track them to closure.
- Help move access reviews to continuous compliance as our tooling matures.
- Audit and compliance support: Prepare evidence for IT audits and assessments, such as ITGC, ISO 27001, OJK, Bank Indonesia and partner security reviews.
- Track findings related to vendor security and access control on the audit issue board, and follow up with owners until they close.
- Support the Security Awareness team with compliance tracking.
- Report on your processes: reviews completed, overdue items, and vendor risk ratings.
About you:
- Bachelor’s degree in Information Technology, Computer Science, Cybersecurity or a related field.
- 3- 5 years in IT GRC, IT audit or information security, preferably in financial services, fintech or banking.
- Hands-on experience with access reviews or third-party/vendor risk assessments.
- Understanding of security frameworks (e.g. ISO 27001, NIST CSF, COBIT) and local regulations such as OJK and Bank Indonesia.
- Experience supporting audits: preparing evidence and responding to auditor requests.
- Organised and detail-oriented, able to run recurring processes on time across many stakeholders.
- Comfortable following up persistently with teams you don’t manage.
- Good written and spoken English and Bahasa Indonesia.
- Nice to have: Experience at a consulting or audit firm in IT audit, risk or compliance. CISA or ISO 27001 Lead Auditor, or working towards one. Experience with GRC tools or workflow automation (e.g. Jira, n8n).