Head, Cyber & Governance

• Lead and manage the organization's Cyber Incident Response Team, including hands-on participation in incident response and recovery activities.
• Oversee the Governance, Risk, and Compliance (GRC) function to support both internal operations and external client engagements.
• Collaborate with IT infrastructure teams on the design, assessment, implementation, and review of security solutions and initiatives.
• Evaluate, test, implement, and maintain enterprise cybersecurity tools and systems, ensuring they align with organizational needs and threat landscapes.
• Develop, maintain, and review cybersecurity policies, procedures, standards, and frameworks to ensure compliance with relevant regulations and certifications (e.g. Cyber Trust Mark, Data Protection Trust Mark, PDPA).
• Support the CDTO in preparing materials and reports for senior leadership, including participation in Audit and Risk Committee (ARC) meetings.
• Drive periodic risk assessment exercises, maintain risk registers, and ensure timely reporting of cybersecurity risks and mitigation actions.

Requirements:

• Experience: Minimum of 5 years in cybersecurity, including at least 1 years in a managerial or leadership role.
• Certifications: Professional certifications such as CISSP, CISM, CRISC, or CISA are required. Additional credentials (e.g. GSEC, GIAC, ISO Lead Implementer) are advantageous.
• Framework Knowledge: Familiarity with security and privacy standards and frameworks such as ISO/IEC 27001, ISO/IEC 27701, NIST Cybersecurity Framework, and PDPA requirements.
• Technical Proficiency:
• Hands-on experience with cybersecurity tools such as Tenable, KnowBe4, enterprise-grade EDR, DLP, and SIEM platforms.
• Good understanding of IT infrastructure domains including endpoints, servers, databases, applications, and networking.
• Exposure to cloud environments (especially AWS) and cloud security principles is an added advantage.
• Soft Skills: Strong stakeholder engagement, written and verbal communication skills, and ability to present cybersecurity matters to senior leadership and board-level stakeholders.