【Bluebell】亞太區資訊安全經理｜Regional Cybersecurity Manager & Acting DPO

【職務說明】
我們正在尋找一位具備豐富資安實務經驗且具高度韌性的 Regional Cybersecurity Manager & Acting DPO，負責推動集團資訊安全策略，並兼任集團 Data Protection Officer（DPO）。
此職位隸屬於 Group IT & Digital，直接向 亞洲 Head of Cyber Security & IT Infrastructure 匯報，主要負責守護 Bluebell 集團亞洲各市場的數位環境與資訊安全。

** This is a highly hands-on, individual contributor position. You will be the primary driver of both high-level strategy and ground-level technical execution, operating without a dedicated subordinate headcount. We are looking for a practitioner who is just as comfortable writing compliance policies as they are configuring firewall rules and investigating endpoint alerts.

Key Responsibilities:

• Hands-on Cybersecurity Operations:
• Directly oversee the deployment, administration, and optimization of our

Microsoft security stack, including identity management, endpoint protection (XDR), device management, and data loss prevention (DLP) tools.

• Act as the primary technical liaison managing our external 24x7 Security Operations Center (SOC), ensuring SLA adherence, rapid incident triage, and effective threat hunting.
• Personally conduct regular vulnerability assessments, coordinate penetration testing, and execute patch management processes across the regional infrastructure.
• Serve as the primary incident responder for internal escalations, actively investigating and remediating potential security breaches.

• Acting Data Protection Officer (DPO) & Compliance:
• Serve as the Group's subject matter expert on data privacy and cybersecurity regulations across all Asian markets where Bluebell operates.
• Crucial Focus: Maintain a deep, actionable understanding of the stringent data security, cross-border transfer, and privacy regulations specific to all Bluebell markets.
• Lead the creation, implementation, and automated enforcement (via DLP tools) of the Group Data Retention Policy across customer and employee HR data.
• Act as the primary point of contact for regional data privacy regulatory bodies and manage statutory breach notification protocols if required.

• Governance, Risk & Compliance (GRC):
• Develop, maintain, and actively enforce comprehensive IT security policies, standard operating procedures (SOPs), and incident response playbooks.
• Design and conduct security awareness training for corporate staff and retail employees across the region.