Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 129 days ago

IT GRC Analyst

Xendit26 open roles

Where
Jakarta, Indonesia
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowIT GRC AnalystXendit · Jakarta, Indonesia

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Xendit's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

12.3% of postings close within 7 days. Measured by our own scanner across the market. Xendit postings stay open a median of 34 days.

Share of postings closed within
  1. 2.1%1 day
  2. 4.5%3 days
  3. 12.3%7 days
  4. 19.3%14 days
  5. 35.6%30 days
  6. 58.1%60 days
This job: posted 129 days ago

Xendit median: 34 days open

The posting

Xendit is an enterprise payments platform powering complex financial operations across Southeast Asia and global markets. We provide a unified API layer combining payment processing, global payouts, localized FX, identity compliance, and fraud protection. As a trusted financial partner backed by top-tier global investors, Xendit processes high-throughput transaction flows for leading global platforms including Meta, Traveloka, ByteDance, Wise, and Grab, building resilient payment infrastructure to drive regional commerce forward.

About the Job

At Xendit, we are looking for a mid-level/senior-level IT GRC Analyst to sit at the intersection of technology, compliance, and risk — not just for Indonesia, but across all of Xendit's operating markets. As an individual contributor, you will be responsible for ensuring our IT systems, processes, and controls meet the regulatory obligations and certification standards of every jurisdiction we operate in. You will be our regional GRC go-to person, coordinating directly with regulatory bodies across the regions (Bank Indonesia / OJK, BSP, BOT, etc). Beyond regulatory compliance, you will own and drive the full lifecycle of our IT certifications such as PCI-DSS and ISO 27001. You will work closely with engineering, security, product, and legal teams to embed compliance into how we build and operate. This is a role for someone who is detail-oriented, thrives in multi-market complexity, and can translate a wide range of regulatory requirements into practical, actionable controls in a fast-moving fintech environment.

Minimum Qualifications

  • 3–5 years of hands-on experience in IT GRC, IT Risk Management, or IT Compliance roles
  • Solid working knowledge of PCI-DSS, ISO 27001 frameworks, including implementation, certification, and audit readiness
  • Familiarity with Bank Indonesia (BI) and OJK IT governance regulations applicable to payment service providers in Indonesia
  • Exposure to or willingness to take regulatory requirements in at least one other Southeast Asian or international market (e.g., BSP, BOT, MAS, BNM, or equivalent)
  • Proven experience conducting IT risk assessments, control testing, and gap analyses
  • Demonstrated ability to develop, review, and maintain IT policies, standards, and procedures
  • Strong analytical skills with the ability to translate diverse regulatory requirements into technical and operational controls
  • Effective communicator who can engage both technical and non-technical stakeholders across multiple countries and time zones

Preferred Qualifications

  • Prior experience navigating Bank Indonesia's PJP (Penyelenggara Jasa Pembayaran) Category 1 or Category 2 licensing requirements, including ongoing IT compliance obligations and regulatory examination readiness
  • Hands-on experience managing end-to-end certification processes — scoping, readiness assessment, evidence preparation, auditor coordination, and post-certification surveillance — for ISO 27001, PCI-DSS, or SOC 2
  • Direct experience coordinating IT audits or regulatory examinations with regional bodies such as BSP (Philippines), BOT (Thailand), MAS (Singapore), BNM (Malaysia), etc
  • Relevant professional certifications such as CISA, CRISC, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor
  • Prior experience in fintech, digital payments, or financial services in a multi-market Southeast Asian or global context
  • Exposure to cloud environments and understanding of cloud security control frameworks
  • Background in working cross-functionally with engineering and product teams to embed compliance-by-design principles

Responsibilities

  • Own and support Xendit's compliance programs for certification and regulatory audits, ensuring controls are implemented, tested, and evidenced effectively
  • Serve as the primary GRC point of contact for regional regulatory needs, coordinating IT-related audit and examination processes with regional regulatory bodies
  • Manage the full certification lifecycle for applicable frameworks — from initial scoping and gap analysis through certification issuance and ongoing surveillance — ensuring timely renewals and continuous compliance
  • Conduct periodic IT risk assessments across markets, maintain a consolidated IT risk register, and track remediation activities through to closure
  • Perform internal control testing and assessments to evaluate the design and operating effectiveness of IT controls across Xendit's regional entities
  • Identify compliance gaps across markets and work with relevant teams to develop and execute remediation plans
  • Develop, review, update, and enforce IT policies, standards, and procedures in line with multi-jurisdictional regulatory and framework requirements
  • Coordinate regulatory and third-party audits end-to-end, including preparing evidence packages, managing auditor requests, and facilitating examiner meetings
  • Monitor the evolving regulatory landscape across all operating markets and assess the impact of new or updated requirements on Xendit's IT environment
  • Produce compliance dashboards, regional status reports, and management briefings to keep stakeholders informed of GRC posture across all markets
  • Collaborate with engineering, product, security, and legal teams to embed compliance and risk considerations into project delivery and system design
  • Support continuous improvement of GRC processes, tooling, and automation to scale compliance operations efficiently across a growing number of markets
From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Xendit's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Xendit's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Xendit's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.