Kerja Sepenuh Masa, Third-Party Due Diligence Specialist di OCBC Federal Territory - Maukerja

Job Summary

Conduct risk-based due diligence for third-party service arrangements, with a focus on technology (including digital and information security risks), cybersecurity, and operational resilience risks. This position requires close collaboration with key internal teams and external service providers.

Key Responsibilities

• Perform and document risk assessments, update questionnaires as required and follow up with stakeholders to obtain complete and accurate information.
• Conduct risk- and context-based due diligence, including site visits, with a focus on information security, technology architecture, cybersecurity maturity, regulatory compliance, business continuity and physical security risks.
• Evaluate vendor controls across key domains, including but not limited:

1. Information security and cybersecurity controls (including continuous monitoring of cybersecurity posture).
2. Cloud, infrastructure, and data protection risks
3. IT resilience, BCP/DR, and incident response

• Identify control gaps and risk exposures, and assess inherent and residual risk, including recommendations for mitigation.
• Provide subject matter advisory support in managing identified issues by reviewing remediation action tracking and evaluating the timelines and adequacy of controls.
• Prepare and present risk reports, dashboards, and insights to stakeholders and management.
• Collaborate with policy owners to ensure alignment with governance and regulatory requirements. Partner with service owners, business units, risk type owners, Procurement, Compliance, Legal, and other assurance functions in the second and third line of defence to identify and appropriately escalate third-party risks.

Qualifications & Experience

• Degree in Information Security, Cybersecurity, Information Technology, Risk Management, or related field

• 3-5 years of experience in TPRM, Technology Risk, Cybersecurity, IT audit, or due diligence.

• Strong knowledge and experience:

1. Cybersecurity frameworks (e.g., ISO 27001, NIST CSF), BNM RMiT, MAS TRM (Monetary Authority of Singapore Technology Risk Management), Third-party risk management (TPRM)
2. Vendor security questionnaires, Outsourced Service Provider Audit Report (OSPAR), System and Organization Controls (SOC) reports, and ISO certifications
3. Vulnerability assessments and penetration testing (VAPT) outputs to determine residual risk
4. IT control design, gap analysis, and operating effectiveness assessment