About Risk
The Risk Department safeguards the business by identifying, assessing, and mitigating potential risks across operations and business processes. The team works to ensure a secure, reliable, and trusted experience by strengthening risk management and control mechanisms.
By working closely with cross-functional teams and leveraging data-driven insights, the department proactively manages risk exposure while supporting business growth. With a strong focus on accuracy, prevention, and continuous improvement, the Risk Department plays a critical role in protecting both customers and the company.
About the role
As Enterprise Risk Governance & Reporting Lead, you will lead DANA's enterprise risk management, AI governance, stress testing, risk policies, committee reporting, and business continuity programs in line with regulatory and industry standards.
You'll be working on:
- Establish and continuously improve DANA's Enterprise Risk Management framework, aligned to ISO 31000:2018 and COSO ERM.
- Coordinate the establishment and periodic review of DANA's risk appetite and tolerance.
- Build and maintain the Enterprise Risk system and the risk & control matrix, with Business Enablement (Internal Control) and the SOP function.
- Identify, register, and monitor Key Risk Indicators (KRIs); confirm activity remains within tolerance; propose KRIs and appetite to ExCom and coordinate finalization.
- Prepare periodic reporting on KRI status and the risk acceptance register to ExCom and the Risk Committee, and review KRI/appetite applicability.
- Own DANA's AI risk governance: maintain the AI Governance Policy, the AI Project Assessment Register, and the AI Risk Register; classify AI use cases against the risk taxonomy.
- Coordinate the AI governance committee cadence and escalation routing (higher-tier use cases to Department and IT Security; personal-data use cases to the PDP Working Group; specified processing to ExCom).
- Track emerging and technology-driven risks and translate them into KRIs, policy, and committee escalation.
- Coordinate enterprise-wide stress testing and scenario analysis (macroeconomic and liquidity), integrating results into risk appetite and capital-adequacy monitoring.
- Develop, review, and update risk management policies, procedures, and guidelines aligned to regulatory requirements and industry best practice.
- Maintain forward regulatory horizon scanning across the Bank Indonesia stack (payment-system, e-money, and related BSPI initiatives) and coordinate DANA's readiness response.
- Coordinate with the PDP function on personal-data risk arising across the enterprise.
- Collaborate with cross-functional teams to embed risk policies and procedures organization-wide.
- Act as Secretary to the Risk Committee; provide regular escalation and reporting.
- Facilitate Business Continuity Management: assess Business Impact Analyses, develop BCP/DRP with business and system owners, and ensure exercises are performed and evidenced.
- Develop and deliver risk management training, workshops, and the Risk Culture Campaign to raise risk awareness and capability across the organization.
- Prepare the risk & control matrix assessment.
Qualifications:
- Bachelor's degree in Business Administration, Finance, Risk Management, or a related field; Master's degree preferred.
- Minimum 8 years of relevant experience, including hands-on ERM framework work (ISO 31000 / COSO).
- Working knowledge of Bank Indonesia payment-system regulation (payment services, e-money, and related standards).
- Exposure to AI, technology, or emerging-risk governance — strongly preferred.
- Familiarity with stress testing and scenario analysis.
- Relevant certification (ISO 31000 Lead Implementer, ERMCP, or equivalent) is a plus.
- Strong negotiation skills and the ability to handle difficult conversations; confident under pressure.
- Excellent written and spoken Indonesian and English; excellent report-writing skills.
- Good knowledge of financial-institution industry trends, regulation, business process, and system usage.
