IT GRC

requirements in at least one other Southeast Asian or international market (e.g., BSP, BOT, MAS, BNM, or equivalent) Proven experience conducting IT risk assessments, control testing, and gap analyses Demonstrated ability to develop, review, and maintain IT policies, standards, and procedures Strong analytical skills with the ability to translate diverse regulatory

requirements into technical and operational controls Effective communicator who can engage both technical and non-technical stakeholders across multiple countries and time zones Preferred

Qualifications Prior experience navigating Bank Indonesia's PJP (Penyelenggara Jasa Pembayaran) Category 1 or Category 2 licensing

requirements, including ongoing IT compliance obligations and regulatory examination readiness Hands-on experience managing end-to-end certification processes — scoping, readiness assessment, evidence preparation, auditor coordination, and post-certification surveillance — for ISO 27001, PCI-DSS, or SOC 2 Direct experience coordinating IT audits or regulatory examinations with regional bodies such as BSP (Philippines), BOT (Thailand), MAS (Singapore), BNM (Malaysia), etc Relevant professional certifications such as CISA, CRISC, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor Prior experience in fintech, digital payments, or financial services in a multi-market Southeast Asian or global context Exposure to cloud environments and understanding of cloud security control frameworks Background in working cross-functionally with engineering and product teams to embed compliance-by-design principles

Responsibilities Own and support Xendit's compliance programs for certification and regulatory audits, ensuring controls are implemented, tested, and evidenced effectively Serve as the primary GRC point of contact for regional regulatory needs, coordinating IT-related audit and examination processes with regional regulatory bodies Manage the full certification lifecycle for applicable frameworks — from initial scoping and gap analysis through certification issuance and ongoing surveillance — ensuring timely renewals and continuous compliance Conduct periodic IT risk assessments across markets, maintain a consolidated IT risk register, and track remediation activities through to closure Perform internal control testing and assessments to evaluate the design and operating effectiveness of IT controls across Xendit's regional entities Identify compliance gaps across markets and work with relevant teams to develop and execute remediation plans Develop, review, update, and enforce IT policies, standards, and procedures in line with multi-jurisdictional regulatory and framework

requirements Coordinate regulatory and third-party audits end-to-end, including preparing evidence packages, managing auditor requests, and facilitating examiner meetings Monitor the evolving regulatory landscape across all operating markets and assess the impact of new or updated

requirements on Xendit's IT environment Produce compliance dashboards, regional status reports, and management briefings to keep stakeholders informed of GRC posture across all markets Collaborate with engineering, product, security, and legal teams to embed compliance and risk considerations into project delivery and system design Support continuous improvement of GRC processes, tooling, and automation to scale compliance operations efficiently across a growing number of markets

A meeting lands on your calendar

If they’re a yes, I book the chat. You show up — that’s the whole job-hunt.