Eastspring is a global asset manager with Asia at its core. We create a culture in which diversity is celebrated and inclusion assured, for our colleagues, customers, and partners. We provide a platform for our people to do their best work and make an impact to the business, and in exchange, we support our people's career ambitions. We pledge to make Eastspring a place where you can Connect, Grow and Succeed.
.
.
Key Responsibilities
A. IT Security Governance and Programme Leadership
• Develop, maintain and execute the local IT Security Programme and multi-year security roadmap, aligned with Group requirements, regulatory expectations and business priorities.
• Coordinate implementation of Group information security policies, standards, minimum controls and security initiatives.
• Lead requirements definition, solution and control design reviews, implementation oversight and security governance forums.
• Assess control effectiveness, identify systemic weaknesses, prioritise remediation and promote cybersecurity awareness across stakeholders.
• Maintain the IT governance framework, document repository, policy inventory, review calendar, ownership records, approval evidence, version control and retention records.
B. Technology Risk and Control Management
• Lead technology and application risk assessments for applications, projects, infrastructure changes and third-party services.
• Evaluate inherent risk, control design, residual risk, compensating controls and risk treatment plans, and provide practical advice to system owners and project teams.
• Own the Technology Risk Register, Department Risk Register, control inventory, KCSA records, risk acceptance records, review dates, dependencies and Key Risk Indicators.
• Coordinate submissions from control owners, verify completeness and internal consistency, and escalate missing evidence, overdue treatment actions and material changes.
• Facilitate risk identification, formal acceptance, treatment monitoring and closure validation.
C. Cybersecurity Operations Governance
• Govern vulnerability management, patch management and security remediation across infrastructure and applications.
• Review vulnerability exposure, patch compliance, BISO dashboards, security metrics and related management information.
• Coordinate penetration testing, application security assessments, secure-development control reviews and remediation validation.
• Coordinate firewall-rule reviews, DLP control reviews, web-defacement monitoring and threat-intelligence escalations.
• Maintain evidence for security operations reviews, attestations, risk acceptance and remediation closure.
D. Identity and Access Management Governance
• Oversee periodic user-access reviews, privileged-account reviews, access certifications and compliance attestations.
• Govern IAM platforms, CyberArk privileged identities, Kbolt reconciliations, segregation-of-duty concerns, privileged-ID compliance and application access controls.
• Ensure the completeness and accuracy of IAM feed files, reconciliation records and application access data.
• Oversee locally administered access to banking and business platforms, including exceptions and overdue remediation.
E. Third-Party Security and Outsourcing Risk
• Lead third-party security oversight and technology vendor risk assessments for new and existing service providers.
• Review TISQ assessments, security questionnaires, Coupa CRA submissions and outsourced service-provider evidence.
• Track vendor remediation commitments, exceptions, reassessments and closure evidence in coordination with Group stakeholders.
• Advise business and technology owners on security and control risks arising from outsourcing and supplier arrangements.
F. Cyber Resilience, Incident Governance and Crisis Support
• Coordinate Business Impact Analysis, Disaster Recovery and Business Continuity Plan reviews.
• Plan and facilitate cyber drills, recovery testing and technology-resilience exercises, including…