IT GRC Analyst

Career Tools

About This Role

Xendit operates as a financial technology platform that furnishes businesses with a single unified infrastructure layer for treasury, financial services, payouts, and payment acceptance. The organization caters to companies of varying scales, ranging from high-growth startups to global enterprises, handling high-volume transactions across Southeast Asia alongside plans for continued global expansion. The company seeks a mid-level or senior-level IT GRC Analyst to operate on-site as an individual contributor positioned at…

Job Description

Responsibilities

• Manage compliance programs for regulatory audits and certifications, guaranteeing that controls are effectively evidenced, tested, and implemented.
• Act as the principal GRC contact for regional regulatory needs, facilitating IT-related examinations and audits with regional regulatory entities.
• Oversee the complete lifecycle for applicable frameworks from scoping and gap analysis through to certification issuance, ongoing surveillance, and renewals.
• Perform periodic IT risk assessments throughout all markets, maintain a centralized IT risk register, and monitor remediation efforts to completion.
• Conduct internal control assessments and testing to measure the operational effectiveness and design of IT controls across regional entities.
• Identify cross-market compliance gaps and cooperate with appropriate teams to create and implement remediation plans.
• Create, review, enforce, and revise IT standards, policies, and procedures to match framework and multi-jurisdictional regulatory demands.
• Coordinate third-party and regulatory audits end-to-end by preparing evidence packages, handling auditor inquiries, and organizing examiner meetings.
• Track the changing regulatory environment across operating markets to evaluate how new or updated regulations impact the IT ecosystem.
• Generate regional status reports, management briefings, and compliance dashboards to update stakeholders on the GRC posture.
• Partner with legal, product, security, and engineering groups to integrate risk and compliance principles into system design and project delivery.
• Contribute to the continuous enhancement of GRC tooling, processes, and automation to scale operations efficiently across expanding markets.

Requirements

• Possess three to five years of hands-on experience working in IT compliance, IT Risk Management, or IT GRC functions.
• Demonstrate solid working knowledge of ISO 27001 and PCI-DSS frameworks, encompassing audit readiness, implementation, and certification.
• Display familiarity with OJK and Bank Indonesia IT governance regulations that apply to payment service providers in Indonesia.
• Show exposure to or willingness to accept regulatory requirements in at least one extra international or Southeast Asian market such as MAS, BOT, BSP, BNM, or similar equivalents.
• Bring proven experience in executing IT gap analyses, control testing, and IT risk assessments.
• Exhibit a demonstrated ability to develop, maintain, and review IT procedures, standards, and policies.
• Possess strong analytical skills capable of translating diverse regulatory mandates into operational and technical controls.
• Demonstrate effective communication abilities to engage both non-technical and technical stakeholders across multiple time zones and countries.

Qualifications

• Prior experience navigating Bank Indonesia Category 1 or Category 2 PJP licensing requirements, including regulatory examination readiness and ongoing IT compliance duties.
• Hands-on background managing end-to-end certification procedures for SOC 2, PCI-DSS, or ISO 27001, covering scoping, readiness assessments, evidence preparation, auditor coordination, and post-certification surveillance.
• Direct experience coordinating regulatory examinations or IT audits alongside regional bodies such as the BOT, BSP, MAS, or BNM.
• Relevant professional certifications including CRISC, CISA, ISO 27001 Lead Auditor, or ISO 27001 Lead Implementer.
• Prior background working within financial services, digital payments, or fintech across a global or multi-market Southeast Asian setting.
• Exposure to cloud environments along with an understanding of cloud security control frameworks.
• Background collaborating cross-functionally with product and engineering teams to embed compliance-by-design concepts.

Core Skills

Frequently Asked Questions

Answers are based only on the employer’s listing; where it doesn’t say, neither do we.

Sample Interview Questions

AI-generated questions tailored to this specific role — a preview of the full practice set.