Principal Specialist - IT Audit

Why PayNet / Why Now

• Shape trust in Malaysia’s digital payment ecosystem, where platforms such as DuitNow, FPX, MyDebit and JomPAY underpin millions of everyday transactions.
• Work at the intersection of technology, cybersecurity, risk and assurance in an environment where resilience and security have national-scale consequences.
• Join PayNet as technology, cloud adoption, data platforms and secure engineering practices continue to evolve, creating new risks that demand strong and forward-looking assurance.
• Help strengthen how PayNet protects information assets and maintains the integrity, security and availability of critical technology systems.

TL;DR

• Lead technology audits that challenge whether risks and controls are genuinely understood and effectively managed.
• Apply cybersecurity, cloud, data and DevSecOps expertise to identify control weaknesses and emerging technology risks.
• Exercise independent judgment to determine what matters, why it matters and what needs to change.
• Influence management through clear, evidence-based audit conclusions and practical recommendations.
• Follow findings through to sustainable remediation rather than treating report issuance as the finish line.

Why This Role Matters

• PayNet operates technology that supports Malaysia’s digital payment ecosystem, making strong technology governance and controls fundamental to trust and resilience.
• This role provides independent assurance that technology risks are identified, understood and managed with appropriate controls.
• Your judgment will help uncover weaknesses across cybersecurity, cloud, data platforms, technology infrastructure and engineering practices before they become larger issues.
• Your recommendations will influence how PayNet strengthens controls, improves operational effectiveness and responds to evolving technology risks.
• This role requires judgment over process: strong assurance comes from understanding risk and challenging controls, not simply completing an audit checklist.

What You Will Actually Do

• Lead technology audits independently or with a wider audit team, turning complex technical risks into clear assurance conclusions.
• Evaluate governance, risk management and internal controls across technology systems, infrastructure, cybersecurity, cloud environments, data platforms and technology operations.
• Shape practical recommendations that address root causes, strengthen controls and improve the organisation’s resilience and effectiveness.
• Influence management and Board-level stakeholders through clear, evidence-based communication of audit findings, risks and recommended actions.
• Drive audit observations through remediation by challenging whether corrective actions address the underlying risk and deliver sustainable improvement.
• Build robust audit programmes, work papers and evidence that clearly demonstrate how audit conclusions were reached.

Examples of This Role in Practice

• Assess whether security controls around a cloud environment appropriately protect sensitive information and challenge gaps that expose PayNet to material risk.
• Review cybersecurity controls following changes in threats, technologies or operating models and determine whether existing safeguards remain effective.
• Examine database or data-lake controls and identify weaknesses affecting access, security, integrity or governance of critical data.
• Evaluate DevSecOps practices to determine whether security is effectively embedded throughout the software development and deployment lifecycle.
• Challenge a remediation plan that appears complete on paper but does not resolve the underlying cause of an audit observation.
• Translate a technically complex control weakness into a clear explanation of business risk and required action for senior stakeholders.

What Will Help You Succeed

• Required: Strong practical knowledge of cybersecurity and/or cloud security, with the ability to translate technical concepts into risk and control implications.
• Required: Experience with database or data-lake operations/security and/or DevSecOps practices, combined with the judgment to assess whether controls are genuinely adequate.
• Required: Strong critical and analytical thinking, particularly when evidence is incomplete, controls are complex or the right conclusion is not immediately obvious.
• Required: Clear communication and presentation skills, including the confidence to challenge constructively and explain audit conclusions to technical and senior stakeholders.
• Helpful: Exposure to payment systems, technology audit or major consultancy environments, and data analytics techniques or tools.
• Helpful: Practical knowledge of recognised technology and security frameworks such as ISMS, COBIT and PCI DSS, or other relevant IT standards.

What changed

• Removed task-heavy wording such as “responsible for” and “ensure” in favour of Lead, Evaluate, Shape, Influence, Drive, and Build.
• Made the role’s real technical focus clearer: technology audit + cybersecurity/cloud + data/DevSecOps + risk and controls.
• Separated required capabilities from helpful differentiators, making candidate screening easier.
• Added practical scenarios so candidates can quickly judge whether their actual experience matches the role.
• Preserved the original JD requirements without adding arbitrary years of experience or unnecessary qualification barriers.