IT Governance Manager
Job Responsibilites:
Own and maintain the IT Governance Framework, Technology Risk Management Framework, technology policies, standards, control register and governance calendar.
Coordinate technology compliance across PCI DSS, BNM/PayNet requirements, PDPA, internal audit and customer/partner assurance requests.
Establish and operate technology governance forums, including preparation of risk dashboards, material incident reports, control exceptions, strategic-project updates and management/Board reporting.
Maintain the technology risk register; facilitate risk assessments, treatment plans, risk acceptance and timely escalation of material residual risks.
Lead governance for third-party service providers: due diligence, security assessments, contractual control requirements, concentration risk, subcontractor oversight, annual reviews and exit/contingency planning.
Govern critical technology changes, architecture decisions, production access exceptions and control deviations, ensuring appropriate approvals and auditable evidence.
Partner with Engineering, DevOps, Security, Product and Operations to embed governance into delivery: secure SDLC, vulnerability remediation, access management, logging, monitoring, incident management and BCDR testing.
Track remediation from audits, penetration tests, PCI assessments, incidents and DR exercises through to verified closure.
Maintain an evidence repository that is audit-ready, complete and current.
Support governance of major initiatives.
Develop practical governance awareness for technology and business teams; focused on accountability, not paperwork for its own sake.
Job Requirements
Bachelor's degree in IT, Computer Science, Cybersecurity, or a related field.
7–10 years of experience in IT governance, technology risk, or compliance, preferably in fintech or financial services.
Strong knowledge of PCI DSS, BNM/PayNet requirements, PDPA, and technology risk frameworks.
Experience in audit management, risk assessments, third-party risk, and regulatory compliance.
Understanding of IT controls, secure SDLC, access management, incident management, and business continuity.
Strong stakeholder management, analytical, and communication skills.
CISA, CRISC, CISM, CISSP, or ISO 27001 certifications are an advantage.