Operational Risk & Governance Officer

EMPLOYEE QUALIFICATION CRITERIA

Operational Risk & Governance

1. Educational Qualifications

a. Minimum Bachelor's Degree (S1) in one of the following fields:

• Computer Science
• Information Technology
• Information Systems
• Risk Management

b. Certifications (Optional):

• ISO 27001 Lead Implementer / Lead Auditor
• CRISC (Certified in Risk and Information Systems Control)
• CISA (Certified Information Systems Auditor)
• CISSP (Certified Information Systems Security Professional)

c. Understanding and knowledge of:

• IT Governance Frameworks
• COBIT (Control Objectives for Information and Related Technologies)
• ITIL (Information Technology Infrastructure Library)

---

2. Work Experience

a. Minimum 3–5 years of experience in the following areas:

• IT Governance
• IT Risk Management
• Information Security
• IT Compliance
• Internal Control

b. Experience in the following industries is considered an advantage:

• Financial Services
• Banking
• Payment Gateway
• Other highly regulated industries

---

3. Professional Experience and Competencies

a. Experience in developing and maintaining company policies, SOPs, and procedures.

b. Experience in conducting IT risk assessments and information security assessments.

c. Experience in supporting internal and external audits.

d. Knowledge and understanding of relevant regulations, including:

• Bank Indonesia regulations
• Personal Data Protection (PDP) regulations
• Information security regulations related to the payment industry

e. Ability to develop and maintain risk registers, perform risk assessments and gap assessments, establish risk mitigation plans, and monitor residual risks to ensure the effectiveness of controls and continuous risk mitigation.

f. Knowledge of and experience with:

• Access Control Management
• Patch Management
• Backup & Recovery
• Incident Management
• Vulnerability Management
• Business Continuity Management (BCM)

g. Ability to conduct and manage:

• Phishing Simulations
• Cybersecurity Awareness Programs
• Disaster Recovery Plan (DRP) Exercises
• Business Continuity Plan (BCP) Exercises
• Tabletop Exercises
• Call Tree Exercises

to strengthen information security and operational resilience.

h. Understanding and experience in:

• Merchant KYC (Know Your Customer) processes
• Merchant risk profiling
• Transaction limit monitoring
• Fraud detection scenario development
• Merchant risk filtering based on risk profiles

to ensure compliance, risk mitigation, and effective fraud prevention.

i. Experience in preparing and submitting regulatory reports to Bank Indonesia (BI).

j. Experience in implementing Risk and Control Self-Assessment (RCSA) across IT and business units.

k. Ability to oversee and govern IT Change Management processes.

---

4. Soft Skills

a. Strong communication and cross-functional coordination skills.

b. Strong analytical, risk assessment, and problem-solving abilities.

c. Detail-oriented in documentation and compliance monitoring.

d. Strong presentation and management reporting skills.

e. Ability to work independently as well as collaboratively within a team.

f. Adaptability to regulatory changes and emerging cybersecurity threats.

---

5. Personal Characteristics and Competencies

a. High integrity and commitment to maintaining the confidentiality of company information and data.

b. Strong sense of ownership toward governance, risk, and compliance processes.

c. Proactive mindset in identifying opportunities for control and process improvements.

d. Strong risk-awareness mindset and commitment to continuous improvement.