Lead, Corporate Governance

University of Southampton Malaysia (UoSM) is seeking to recruit a dynamic Lead, Corporate Governance to be based in Iskandar Malaysia, Johor Bahru.

Job Description

This position is responsible for University's corporate governance by owning the policy framework, coordinating statutory and regulatory compliance, and serving as the Privacy Officer or DPO under the PDPA. Drive PDPA compliance and incident response, track enterprise risk and audit actions, and provide light legal and contract governance for standard agreements so that decisions are lawful, well documented, and aligned with the Delegation of Authority.

In carrying out the responsibilities, the post holder helps ensure that decision-making is lawful, ethical, and well-documented; that policies and contracts follow approved templates and Delegation of Authority; and that personal data processing complies with statutory requirements including DPO appointment, breach notification, data-subject rights, and cross-border transfer controls.

Responsibilities

1) Governance Framework & Policy Management.

• Custodian of policy framework governing legal documents and processes including Terms of Reference and maintaining official repository with version control and archiving; ensure a single source of truth.
• Manage and coordinate the migration of the current Business Rules to either Policy or Procedure and accompanying Guideline or Work Instruction.
• Reference point for stakeholders in establishing policy documents.
• On-going management of policy document, ensuring proper process are taken - scrutinised by a working group and tabled to an identified approving authority.
• Manage the guideline on writing, amendments and review frequency.
• In-charge of determining the level or category of policy documents

2) PDPA & Privacy (Deputy DPO / DPO duties).

• Advise on PDPA obligations, monitor compliance and act as contact point with JPDP.
• Maintain record of processing; keep privacy notices current; confirm lawful bases/consent.
• Coordinate data-subject rights responses within timelines; log requests and outcomes.
• Run vendor privacy due diligence; ensure contracts include PDPA clauses; assess cross-border transfers.
• Facilitate the Data Protection Impact Assessment (DPIAs); maintain breach register and coordinate notification as required.
• Deliver targeted PDPA training to high-risk teams not limited to Admissions, People & Culture, IT & Estate, Finance, Recruitment & Marketing, and Research.

3) Risk and Internal Control Coordination.

• Support enterprise risk cycles and compile risk registers with risk owners.
• Track internal/external audit actions to closure and prepare status snapshots.
• Align risk, controls and assurance reporting for the Senior Leadership Team (SLT); prepare concise risk snapshots for SLT meetings.
• Manage and coordinate internal audits that includes:

i. Manage non-conformances

ii. Conduct thematic reviews and ensures that recommendations of closing the loop are tabled at relevant or identified approving authority

iii. Conduct continuous quality improvement

4) Legal & Contract Governance (NDAs / MoUs / MoAs).

• Govern low-to-medium risk instruments using approved templates (NDAs, MoUs, MoAs, service agreements, DPAs, addenda).
• Triage matters for Legal review; track deviations/redlines and approvals per Delegation of Authority (DoA).
• Coordinate e-signature/wet-ink and stamping; file executed copies with renewal/expiry alerts.
• Complete counterparty due diligence (e.g., SSM lookup) and ABAC checks where relevant.

5) Uni-wide Archive and Repository.

• Create and maintain a proper archive and repository.
• Ensure continuity and sustainability of documents and records.
• Utilise SharePoint with limited editable access rights (to protect accuracy and version control of documents published).
• One-stop-centre and single source of truth for UoSM

6) Regulatory and Statutory Compliance Support

• Coordinate corporate filings and licenses (e.g., SSM/MBRS) with Company Secretary/Legal.
• Support MoHE/MQA/ KDN touchpoints where corporate governance inputs are required.
• Maintain statutory/corporate registers and a live obligations tracker with owners and due dates.
• Assist with queries and scheduled/unscheduled visits by Enforcement & Inspectorate Division, MOHE.
• Assist with application and maintenance of licenses:

i. International Student Recruitment License

ii. Compliance Audit (Audit Pematuhan) by MoHE

iii. University Registration Certificate

7) Business Continuity & Incident Governance.

• Keep the University's Business Continuity Plan (BCP) and incident contact list up to date for key functions (IT, Admissions/Exams, Estates, Finance).
• Maintain the incident log and do a short after-action review after any disruption (e.g., power/IT outage, flood, public-health event) to update the BCP/procedures.

Requirements

1) Bachelor's degree in Law, Accounting, Business, Public Policy, or a related field.

2) Experience in corporate governance, company secretariat functions, compliance, or risk management.

3) Familiarity with PDPA 2010 and JPDP guidelines, Companies Act 2016, SSM/MBRS submissions, and regulatory interfaces related to MoHE and MQA.

4) Ability to review NDAs, MoUs, and MoAs, with a solid understanding of contract law principles or a strong willingness to learn.

5) Strong capability to plan, implement, and manage governance, compliance, privacy, and contract workflows.

6) Excellent document control, record management, and process-tracking skills.

7) Excellent proficiency in English and Malay, both written and spoken.

8) Ability to handle confidential and sensitive information professionally.

9) Experience in higher education, relevant professional certifications, or experience implementing contract/policy management systems is an added advantage.

10) Experience in mapping and improving end-to-end governance or contract processes is desirable.