Security Assurance & Reverse TPSA , Manager

Role Purpose

The Reverse TPSA Manager is responsible for managing and coordinating security, technology risk,

privacy, and compliance assessments conducted by company’s clients, brokers, consultants, and

prospective customers.

The role serves as the central point of contact for all client security due diligence activities, ensuring

timely and accurate responses to Third-Party Security Assessments (TPSAs), Requests for Security

Information (RFSIs), client audits, and cybersecurity questionnaires. The individual will work closely

with Information Security, Technology, Risk Management, Legal, Compliance, Privacy, Procurement,

and Business Units to articulate company’s security posture and control environment while

protecting confidential and proprietary information.

This role is critical in enabling business growth, strengthening client trust, and demonstrating

company's commitment to cybersecurity, operational resilience, and regulatory compliance.

Key Responsibilities

Reverse TPSA Management

• Lead and manage end-to-end client Third-Party Security Assessment (TPSA) activities.
• Serve as the primary coordinator for security due diligence requests from Corporate Solutions clients and prospective customers.
• Review, assess, and complete security questionnaires covering cybersecurity, cloud security, data protection, operational resilience, business continuity, and regulatory compliance.
• Ensure responses are accurate, consistent, evidence-based, and aligned with company’s security standards.
• Track TPSA requests and ensure completion within agreed timelines and service levels.

Client Security Assurance

• Represent company's cybersecurity and technology risk control environment during client due diligence engagements.
• Support client discussions, workshops, and security review meetings.
• Explain technical controls and security practices in clear business language suitable for nontechnical stakeholders.
• Address security concerns raised by clients and coordinate responses with relevant subject matter experts.

Stakeholder Management

• Collaborate with:

o Information Security

o Technology Services

o Enterprise Architecture

o Data Privacy Office

o Legal

o Compliance

o Operational Risk

o Corporate Solutions Business

o Third-Party Risk Management Teams

• Coordinate collection of evidence and validation of control effectiveness.

• Escalate complex security or compliance issues where required.

Documentation & Evidence Management

• Maintain a centralized repository of:

o Standard TPSA responses

o Security evidence packages

o Regulatory and compliance documentation

o Frequently requested client artifacts

o Security certifications and attestations

• Ensure all externally shared information complies with company's information classification and disclosure requirements.

• Conduct periodic reviews of security response libraries to maintain accuracy and relevance.

Regulatory & Compliance Support

• Support responses related to:

o BNM Risk Management in Technology (RMiT)

o Personal Data Protec􀆟on Act (PDPA)

o ISO 27001

o NIST Cybersecurity Framework

o Company Group Security Standards

o Operational Resilience requirements

• Ensure client responses remain aligned with prevailing regulatory obligations and corporate policies.

Metrics & Continuous Improvement

• Develop and maintain TPSA performance metrics and reporting dashboards.
• Monitor trends in client security requirements and emerging cybersecurity expectations.
• Identify recurring assessment themes and recommend process improvements.
• Improve automation, standardization, and efficiency of security assessment responses.

Required Qualifications

- Bachelor's Degree in Information Security, Cybersecurity, Information Technology, Risk Management, Computer Science, or a related discipline.

• Minimum 5-8 years of experience in:

o Information Security

o Technology Risk

o Security Governance

o Security Assurance

o IT Audit

o Third-Party Risk Management

Required Knowledge & Skills

Cybersecurity & Risk Knowledge

• Strong understanding of:

o Information Security Governance

o Cybersecurity Risk Management

o Cloud Security Controls

o Identity & Access Management

o Vulnerability Management

o Incident Response

o Data Protection and Privacy Controls

o Business Continuity and Disaster Recovery

Frameworks & Regulations

• Knowledge of:

o ISO 27001

o NIST Cybersecurity Framework

o SOC Reports

o CIS Controls

o BNM RMiT

o PDPA Malaysia

o Operational Resilience principles

Communication & Stakeholder Management

• Excellent written communication and documentation skills.
• Ability to respond to detailed client security questionnaires.
• Strong stakeholder engagement and influencing capabilities.
• Ability to translate technical controls into concise business-friendly responses.
• Strong presentation and facilitation skills.

Analytical Skills

• Strong problem-solving and critical-thinking capabilities.
• Ability to assess client requirements and map them to existing controls.
• Ability to identify gaps, risks, and potential remediation actions.

Preferred Qualifications

• Professional certifications such as:

o CISSP

o CISM

o CRISC

o CISA

o ISO 27001 Lead Auditor / Lead Implementer

o CCSP

• Experience in:

o Insurance industry

o Financial services sector