Role Purpose
Getronics is seeking an experienced AI Governance & Compliance Lead for full-time deployment at a leading financial services organisation in Malaysia. This client-embedded resource role sits at the intersection of enterprise AI governance, risk management, and regulatory compliance.
The individual will be responsible for adopting and operationalising an established Group-level AI policy and governance framework within the Malaysia entity, ensuring it is practically embedded into day-to-day operations across a growing and strategically significant AI portfolio.
This is not a hands-on technical implementation role. The successful candidate will work alongside solution architects,vendors, and business stakeholders to provide governance oversight, compliance assurance, and risk management support ensuring that AI initiatives are delivered within a well-governed, accountable, and regulatory-compliant framework.
Key Responsibilities
AI Governance Framework Adoption
- Adopt and localise the client's Group-level AI policy and governance framework for the Malaysia entity, ensuring practical operationalisation rather than a documentation-only exercise.
- Establish and maintain a current inventory of all AI initiatives both active and pipeline mapping each against the framework, applicable controls, and regulatory obligations.
- Define and implement the AI intake and approval process for new use cases, including business justification assessment, risk classification, and governance sign-off workflows.
Oversight of AI Initiatives
- Provide governance and compliance oversight across the organisation's active AI portfolio, spanning platforms across productivity, data analytics, fraud detection, and customer-facing applications including Microsoft Copilot,
- Databricks Genie, and the Fraud, Waste & Abuse (FWA) Platform.
- Define success criteria and acceptance standards for AI initiatives in collaboration with project teams and vendors, and track delivery against those criteria on an ongoing basis.
- Monitor the post-approval lifecycle of AI use cases including performance, risk, and control effectiveness and escalate issues where appropriate.
- Provide governance coverage across both the current portfolio of active initiatives and the broader pipeline of Group-driven AI projects expected to impact Malaysia through the 2027 2030 vision horizon.
Risk, Compliance & Regulatory Alignment
- Ensure all AI initiatives are assessed and governed in accordance with BNM RMiT (Bank Negara Malaysia's Risk
- Management in Technology framework) and the Malaysia National Guidelines on AI Governance and Ethics.
- Conduct AI-specific risk assessments and support Data Protection Impact Assessments (DPIAs) where required.
- Support audit readiness by maintaining governance evidence, control documentation, and reporting artefacts across
- the AI portfolio.
- Contribute to the organisation's AI risk register, ensuring risks are documented, owned, and tracked to closure.
Stakeholder Engagement & Reporting
- Act as the central coordination point between the organisation's internal business, technology, risk, and compliance teams on all AI governance matters.
- Liaise with Group-level governance functions to ensure local adoption remains aligned with Group-level direction and any evolving framework updates.
- Provide regular governance reporting to senior stakeholders, covering AI initiative portfolio status, risk posture, and compliance position.
Future-State Preparation
- Support the gradual buildout of a more mature local AI governance operating model, including tooling assessment and controls for shadow AI, internally developed agents, and LLM-based applications as the programme scales.
- Contribute to the longer-term objective of formal AI Management System certification under ISO/IEC 42001 when organisational AI maturity is sufficiently established.
Required Qualifications & Experience
Governance & Compliance
- Minimum 8 years of experience in technology risk, IT audit, compliance, or governance roles, ideally within financial services or a regulated industry.
- Demonstrable experience operating within or alongside AI, data, or technology programmes in a governance, risk, or compliance capacity.
- Sound understanding of AI governance principles including AI lifecycle management, model risk, data governance, accountability frameworks, and responsible AI concepts.
- Working knowledge of BNM RMiT or equivalent central bank technology risk frameworks; familiarity with Malaysian financial services regulation is a strong advantage.
- Familiarity with ISO/IEC 42001 (AI Management Systems), or related management system standards certification is desirable but not mandatory at this stage.
General
- Experience designing or operationalising governance frameworks, policy structures, and control environments in complex organisational settings.
- Strong stakeholder management and communication skills comfortable engaging at senior leadership and board level as well as with technical delivery teams.
- Ability to work independently and exercise sound judgement in an ambiguous, evolving environment where governance structures are being built alongside active programme delivery.
Preferred Certifications
- CRISC (Certified in Risk and Information Systems Control).
- ISO/IEC 42001 Lead Auditor or Lead Implementer.
- CGEIT or equivalent GRC certification.
- Degree in Computer Science, Information Systems, Risk Management, or a related discipline.
What Success Looks Like
- All active AI initiatives in Malaysia are mapped to the Group governance framework, with clear ownership, risk assessments, and evidence on file.
- A structured AI intake and approval process is in place and being followed for all new use cases.
- BNM RMiT and Malaysian AI governance requirements are visibly embedded in the governance operating model.
- Senior stakeholders receive regular, clear, and accurate reporting on AI governance status across the portfolio.
- The organisation is positioned to absorb the incoming pipeline of Group-level AI initiatives within a scalable and consistent governance framework.