IT Governance Analyst

About Fusang

Fusang is Asia’s first fully-regulated digital securities exchange, pioneering the convergence of traditional finance and blockchain technology.

Licensed by the Labuan Financial Services Authority, we created the world’s first institutional tokenised sukuk—recognised with the IFN Most Innovative Deal 2023 award. With over USD 410 million in tokenised instruments issued, we’re proving that regulated digital securities are the future of capital markets.

Our mission is to build the digital superhighway for traditional finance, making investment opportunities more accessible globally. Backed by 40 years of wealth management expertise through our relationship with Portcullis Group, we combine startup innovation with institutional credibility.

We’re looking for exceptional people who want to shape the future of finance.

Role Overview:

As a licensed digital securities exchange, Fusang operates under the scrutiny of regulators, institutional clients, and external auditors. Our clients run rigorous due diligence processes. Our regulators expect documented, enforceable policies. Our infrastructure must remain continuously monitored to prevent lapses in certificates, domain registrations, and compliance obligations.

We are seeking an IT Governance Analyst to own the operational backbone of our IT governance, compliance, and internal technical audit function. You will maintain the IT policy framework, monitor adherence to processes, respond to regulatory and client security inquiries, and ensure that nothing—a certificate expiry, a policy gap, or an unanswered audit request—falls through the cracks.

While this is not a cybersecurity engineering role, it requires strong technical acumen to act as an effective internal technical auditor. Rather than relying on self-reported evidence or screenshots provided by engineers, you will use your technical skills to establish the true "source of truth." You will independently log into various environments—including cloud systems, Web Application Firewalls (WAF), cybersecurity tools, corporate IT platforms, and SaaS applications—to directly inspect live configurations, audit permissions, and review logs to ensure absolute compliance and regulatory readiness.

Key Responsibilities:

Technical Audit & Source-of-Truth Inspection

Independent System Inspection: Directly log into systems—including cloud environments, Web Application Firewalls (WAF), cybersecurity tools, corporate IT infrastructure, and SaaS platforms—to review live configurations and system logs independently.

Source-of-Truth Verification: Validate security controls and policy compliance through direct system-level inspection, moving beyond reliance on engineer-provided screenshots or self-reported attestations.

Internal Compliance Auditing: Function as an internal technical auditor to continuously test live system parameters and access controls against regulatory requirements, industry benchmarks, and internal policies.

Control Drift & Gap Detection: Spot-check access privileges, security rules, and parameter settings to proactively detect configuration drift, unapproved changes, or policy deviations.

Audit Evidence Management: Gather and maintain verifiable, system-generated logs and evidentiary artifacts to ensure seamless readiness for regulatory inspections and external audits.

IT Policy & Process Governance

Maintain and update the IT policy library (acceptable use, access control, change management, incident response, data classification, vendor management, etc.)

Conduct scheduled policy reviews against regulatory requirements and industry frameworks

Track organisation-wide policy acknowledgement and follow up on non-compliance

Identify process gaps through internal reviews and work with teams to close them

Document and maintain standard operating procedures (SOPs) for key IT processes

Regulatory & Client Compliance

Respond to regulatory inquiries and information requests from MAS, SFC, Labuan FSA, and equivalent bodies

Complete client security questionnaires, due diligence questionnaires (DDQs), and third-party risk assessments

Prepare and maintain evidence packs and control documentation for audits (ISO 27001, SOC 2, internal and external audits)

Coordinate with Legal, Finance, and Operations to ensure alignment on regulatory obligations

Track regulatory changes and assess impact on existing policies and controls

Certificate & Asset Lifecycle Management

Maintain a centralised inventory of SSL/TLS certificates, domain registrations, software licences, and SaaS subscriptions

Track renewal dates and coordinate with IT, DevOps, and vendors to ensure no lapses or service disruptions

Document renewal processes and establish escalation procedures for time-sensitive renewals

Maintain an up-to-date IT asset register for hardware, software, and cloud resources

Risk & Vendor Governance

Maintain the IT risk register, track risks, mitigations, owners, and review cycles

Support third-party vendor assessments and due diligence reviews prior to onboarding

Monitor vendor compliance with contractual security obligations and SLAs

Assist in Business Continuity Planning (BCP) and Disaster Recovery (DR) documentation and testing

Security Awareness & Training

Coordinate IT security awareness programmes and phishing simulation exercises

Track completion of mandatory compliance training across the organisation

Maintain and update onboarding materials related to IT policies and acceptable use

Requirements:

Required

Bachelor's degree in Information Technology, Computer Science, Business, or a related field

Minimum 5 years of experience in IT governance, GRC (Governance, Risk & Compliance), IT compliance, or technology risk roles

Experience with AWS, Cloudflare, GPO and Active Directory settings and logs.

Hands-on experience with at least one compliance framework: ISO 27001, SOC 2, MAS TRM, or equivalent

Experience responding to regulatory inquiries or client security questionnaires and DDQs

Demonstrated ability to manage a policy lifecycle — drafting, reviewing, approving, and enforcing IT policies

Experience maintaining certificate inventories, software licence registers, or similar asset tracking

Strong documentation skills — you write policies, procedures, and audit evidence packs that hold up under scrutiny

Good English communication skills — written and verbal, including executive-level reporting

AI-Assisted Productivity: Comfort using AI-assisted tools such as Claude Code or similar to improve documentation efficiency and workflow automation

Preferred

Professional certification: CISA, CRISC, ISO 27001 Lead Implementer/Auditor, or CompTIA Security+

Experience in financial services, fintech, or a regulated industry (MAS, SFC, Labuan FSA)

Exposure to corporate secretary, trust administration, fund administration, and digital assets.