Executive (Digital Governance)

Type of Employment: -

Contract Basis (2 Years) – Renewable

Role Overview: -

Establish and operate a deliberate Digital Governance capability for Mesra by translating enterprise policies, risk expectations and regulatory requirements into practical controls, project governance standards and assurance routines. The role monitors governance and control health, coordinates risk and remediation, and drives process, automation and system improvements that strengthen internal control while enabling Digital teams to move with clear guardrails and accountable decisions.

What You'll Do: -

Establish and continuously strengthen Digital governance framework and decision rights:

• Maintain fit-for-purpose governance forums, control objectives, approval pathways, escalation routes, exceptions, WPMs, templates and evidence standards

Coordinate Digital risk and compliance management:

• Identify, assess, monitor and report digital, technology, operational and compliance risks across initiatives and live services.
• Maintain accountable owners, treatment plans, residual-risk visibility and overdue-action discipline, and escalate material exposures or control breakdowns promptly.

Set and monitor project and programme governance standards:

• Define proportionate stage gates, minimum artefacts, RAID and dependency management, change control, decision records, quality/readiness evidence, status reporting, closure requirements and lessons learned.
• Monitor adherence across the Digital portfolio and drive corrective action where governance quality is weak.

Embed cybersecurity governance and secure-by-design practices:

• Ensure cybersecurity expectations are considered early in procurement, architecture, delivery and operations; coordinate assessments, vulnerability and privileged-access concerns, remediation, exceptions and evidence with enterprise cybersecurity authorities, while tracking closure of material security actions.

Govern information, data and responsible AI requirements

• Coordinate appropriate requirements for information classification, access, privacy, retention, data handling and responsible AI.
• Ensure ownership, sensitivity, security, human oversight, traceability and control expectations are addressed before solutions are scaled or materially changed.

Govern third-party and technology risk throughout the lifecycle:

• Coordinate risk-based due diligence and ongoing governance for vendors, SaaS, cloud and technology partners across security, privacy, resilience, access, contractual obligations, continuity, concentration, service dependency and exit considerations; track material remediation and recurring supplier-control issues.

Coordinate audit, assurance and remediation to verified closure:

• Prepare and maintain assurance evidence, support control walkthroughs, audits and management responses, coordinate accountable remediation owners and due dates, and challenge repeated findings through root-cause analysis so closure reflects sustained control improvement rather than administrative completion.

Drive process improvement, automation and stronger system-enabled internal controls:

• Identify recurring control pain points and inefficient manual governance activities
• Redesign and automate workflows and strengthen system controls such as approval logic, segregation of duties, validation rules, audit trails, reconciliations, exception handling and automated evidence capture, with post-implementation effectiveness checks.

Provide governance intelligence, reporting and emerging-risk insight

• Produce concise dashboards and management views on risk profile, control health, project governance, assurance findings, remediation ageing, third-party issues and security matters.
• Monitor relevant technology trends, emerging threats and governance developments and translate them into practical implications for Mesra.

Build governance awareness, advisory capability and proactive ownership:

• Engage Digital and business stakeholders early, provide practical guidance, conduct targeted awareness and change interventions, and promote a culture where governance is embedded in design and decision-making, with control ownership understood by the business rather than treated as a periodic compliance exercise.

Ad-Hoc Support:

• Perform ad-hoc duties and assignments as directed by the immediate superior.

Qualifications & Experience: -

• Bachelor's degree in Information Technology, Information Systems, Cybersecurity, Risk Management, Business, Accounting/Finance, Engineering or a related discipline; equivalent relevant experience may be considered.
• Professional credentials such as CISA, CRISC, CGEIT, COBIT, ISO/IEC 27001, PMP, ITIL, or relevant privacy, audit, cloud security, process improvement or third-party risk certifications are an added advantage.
• 3 - 4 years of relevant experience. Direct experience in digital/IT governance, technology risk, IT audit, cybersecurity governance, compliance or internal control is valuable; strong candidates from adjacent environments may be considered where they demonstrate sound control foundations, investigative thinking and learning agility.
• Exposure to digital products, cloud/SaaS, applications, vendors, system delivery or IT operations is preferred. Experience in digital transformation, process automation, process improvement and project/programme management is a strong advantage.

Working Conditions:

• Regular engagement across Mesra, PDB/PETRONAS functions and technology partners; periodic site, project or vendor visits may be required.
• The role may access risk assessments, vulnerabilities, access concerns, audit findings, third-party issues and remediation status; strict confidentiality, professional discretion and least-privilege access are required.
• Additional support may be required during audits, high-risk changes, major project gates, material incidents or urgent governance escalations, including activity outside the normal planned cadence where business impact requires.
• Maintain awareness of technology trends, emerging threats, cybersecurity developments, AI/data governance, project governance practices and evolving regulatory/control expectations relevant to Mesra.

Personal Data Protection: -

Mesra Retail & Café Sdn Bhd ("MESRA") is fully committed to the protection of Personal Data and compliance with the Personal Data Protection Act 2010 (“Act”). Mesra Retail & Café Sdn Bhd ("MESRA") assures that any Personal Data collected, stored, processed and used for the purpose of this registration/application shall comply with the requirements of the Act and only be used within Mesra Retail & Café Sdn Bhd ("MESRA"). We ensure that the data you submit to us remains confidential and is used for the purposes stated in the data privacy.