IT GRC Specialist (SDE 2)

You’ll run two of Kredivo Group’s core compliance processes day to day: vendor security assessments and user access reviews, across all Group entities. You’ll also support IT audits with evidence and follow-up. You’ll work under guidance from senior team members and take on more ownership as you grow.

About the job

• Run two of Kredivo Group’s core compliance processes day to day: vendor security assessments and user access reviews, across all Group entities. You’ll also support IT audits with evidence and follow-up. You’ll work under guidance from senior team members and take on more ownership as you grow.
• Vendor security: Run security assessments for new and existing technology vendors: send questionnaires, collect evidence, review responses, and flag risks.
• Check that contracts with technology vendors include the required information security terms.
• Keep the vendor inventory and assessment records up to date, and follow up on vendor remediation.
• Use and improve the team’s existing automation for vendor assessments.
• Access reviews: Run periodic user access reviews across systems and entities: pull access lists, send them to system owners, track sign-off, and make sure removals actually happen.
• Check that access provisioning and removal follow policy and least privilege.
• Log exceptions and track them to closure.
• Help move access reviews to continuous compliance as our tooling matures.
• Audit and compliance support: Prepare evidence for IT audits and assessments, such as ITGC, ISO 27001, OJK, Bank Indonesia and partner security reviews.
• Track findings related to vendor security and access control on the audit issue board, and follow up with owners until they close.
• Support the Security Awareness team with compliance tracking.
• Report on your processes: reviews completed, overdue items, and vendor risk ratings.

About you

• Bachelor’s degree in Information Technology, Computer Science, Cybersecurity or a related field.
• 3- 5 years in IT GRC, IT audit or information security, preferably in financial services, fintech or banking.
• Hands-on experience with access reviews or third-party/vendor risk assessments.
• Understanding of security frameworks (e.g. ISO 27001, NIST CSF, COBIT) and local regulations such as OJK and Bank Indonesia.
• Experience supporting audits: preparing evidence and responding to auditor requests.
• Organised and detail-oriented, able to run recurring processes on time across many stakeholders.
• Comfortable following up persistently with teams you don’t manage.
• Good written and spoken English and Bahasa Indonesia.
• Nice to have: Experience at a consulting or audit firm in IT audit, risk or compliance. CISA or ISO 27001 Lead Auditor, or working towards one. Experience with GRC tools or workflow automation (e.g. Jira, n8n).

#LI-RR1