IT Security & GRC (Lead/Manager)

Cermati is seeking an experienced IT Security & GRC Lead/Manager to join our dynamic team. As a leading financial technology startup in Indonesia, Cermati simplifies the process of finding and applying for financial products online, enabling users to shop around and apply without visiting a bank. Our team comprises professionals from top tech companies and universities worldwide, fostering a culture of openness, transparency, and meritocracy.

In this role, you will develop and maintain IT policies, standards, and procedures in line with internal and external requirements, including Indonesian regulations such as POJK and PBI. You will coordinate with the Compliance team to perform gap assessments, recommend risk mitigation measures, and ensure that all initiatives and collaborations comply with relevant standards and regulations. Additionally, you will develop and implement role-based access control (RBAC) and least privilege access management, assess the effectiveness of IT controls, and coordinate with IT units to address data requests and audit recommendations.

The ideal candidate will have a minimum of 3 years of experience in Information Security, IT Governance, Risk, and Compliance (IT GRC), or as an IT Auditor in the banking or financial services industry. You should have experience in developing and maintaining IT and information security policies and procedures, strong communication and writing skills, and proven experience in implementing or auditing ISO 27001 and PCI-DSS standards. A good understanding of applicable regulatory requirements from bodies such as OJK, BI, and Kemkominfo is essential. Preferred certifications include CISA, CRISC, or CISSP.

Joining Cermati offers the opportunity to be part of a world-class fintech company with a culture that mirrors Silicon Valley's drive and innovation. We provide a collaborative environment where your contributions directly impact our mission to revolutionize financial services in Indonesia.