Senior Associate :
Compliance, Risk Management & IT Governance
About Creador
Creador is a leading private equity firm in South and Southeast Asia, focused on investing in growth companies. We are committed to fostering growth and unlocking potential in our portfolio companies. Our medium to long term approach centers on strategic initiatives that empower companies to innovate, expand and lead in their markets. To learn more about Creador, please visit our website at www.creador.com.
Role Overview:
The Senior Associate (Compliance, Risk Management & IT Governance) is to support Compliance, Enterprise Risk Management, and IT/Cybersecurity across Creador (HQ) and selected portfolio companies.
This is a hybrid execution and oversight role:
Hands on execution for Creador's compliance and cybersecurity controls
Oversight and coordination of outsourced IT/cybersecurity consultants (TechSaltant)
Post investment risk management and compliance advisory to portfolio companies
The role combines structured governance work with practical implementation.
Reports to:
Head of BPIA & Compliance
Travel: Regional (Philippines, Vietnam, India) – as required
Key Responsibilities:
Compliance & Integrity (Execution)
- Execute AML, ABAC, and integrity compliance activities, including:
- Review Integrity Due Diligence (IDD) reports
- Identify integrity, AML, and ABAC red flags
- Prepare clear internal reports and summarise issues for escalation
- Update existing compliance policies when required to ensure continued relevance and alignment with regulatory, LP, and internal requirements
- Support and contribute to strengthening Creador's compliance pillars, including integrity, AML, ABAC, governance, and ethical culture
- Support rollout, monitoring, and remediation of AML and integrity frameworks
- Deliver or support AML / compliance training for portfolio companies as required
- Support Pre-Investment Governance, Risk and Control Baseline Assessment on Target Companies, and track follow up remediation
Enterprise Risk Management (Advisory & Oversight)
- Provide post investment ERM advisory to portfolio companies
- Conduct or support:
- Risk baseline and gap assessments
- Risk mitigation tracking and follow ups
- Support BPIA engagements where technology or cybersecurity risks intersect with governance
IT Governance & Cybersecurity – Creador (HQ)
- Oversee Creador's IT and cybersecurity compliance activities, including:
- IT and cybersecurity policies
- SaaS vendor security due diligence
- AI tools risk assessments
- Phishing awareness training and simulations
- VAPT and security assessments
- Access controls, MFA/SSO, password management
- Endpoint, MDM, asset management and disposal controls
- Backup, retention, and recovery controls
- Work closely with outsourced IT consultants to:
- Address identified IT and cybersecurity gaps, and Track remediation to closure
- Coordinate company's cybersecurity incident response, including liaison with forensic specialists and tracking remediation actions
- Support IT and cybersecurity readiness for Due Diligence Questionnaire related to new fund fundraising
- Oversee overall IT control environment, including identity access, endpoint security, network controls, and data protection
Vendor Oversight – Outsourced IT Consultants
- Review, challenge, and track outsourced IT consultant deliverable
- Monitor and ensure timely closure of agreed remediation actions
- Escalate delays, control weaknesses, or inadequate deliverables to management
- Identify gaps in outsourced IT deliverables and recommend improvements to strengthen the control environment
- This role is not expected to perform hands-on IT operations, but must possess sufficient IT and cybersecurity knowledge to:
- Understand and assess the scope and adequacy of work performed by outsourced consultants
- Evaluate whether controls and solutions implemented are appropriate, effective, and aligned to best practices
- Provide informed guidance and challenge where gaps, risks, or inefficiencies are identified
- Ensure outsourced IT activities align with Creador's control, security, and business requirements
- Act as an informed oversight function, holding the outsourced IT provider accountable for service quality, control effectiveness, and security standards
Board Presentation
- To prepare and to present findings to key Management/ Board
Value Creation
- Proactively drive new initiatives, develop tools/checklist, provide awareness and education.
Others
- To provide support and assistance in ad hoc engagements, and investigation, if any.
Role Requirements
Candidates must have:
- AML & ABAC expertise, including:
Hands on experience reviewing Integrity Due Diligence (IDD) reports
Familiarity with sanctions screening frameworks (e.g., UN, OFAC, EU) and identification of PEP / UBO risks
Ability to identify AML / Integrity / ABAC/ Sanction red flags
Experience preparing internal summaries and reports for decision making
And ideally have:
- IT & Cybersecurity Governance and Compliance experience, including:
Oversight of organisational IT and cybersecurity compliance
Practical experience working with outsourced service providers
Experience addressing IT and cybersecurity gaps and tracking remediation
Experience supporting Compliance, IT, Cybersecurity DDQs for new fund fundraising
Qualifications And Experience
- Bachelor's degree in Accounting, Finance, or a related field is typically required. A Master's degree in business administration (MBA) or a related field can be beneficial.
- A professional certification such as Certified Internal Auditor (CIA), Certified Public Accountant (CPA), or Chartered Accountant (CA) is highly desirable.
- A minimum of 8+ years experience across:
- Compliance and integrity
- Risk management / ERM
- IT governance and cybersecurity controls
- Hands on execution experience (not advisory only)
- Experience in private equity or multi entity / regional environments is an advantage
Key Attributes
- Comfortable operating in a hybrid execution + oversight role
- Strong follow through and remediation discipline
- Able to operate independently with minimal supervision and exercise judgement in assessing risk and control adequacy
- Able to engage senior stakeholders and external consultants confidently
