Head of Information Security

• Develop and implement information security strategies, policies, standards, and procedures in alignment with business objectives and regulatory requirements.

• Lead the implementation and maintenance of ISO/IEC 27001:2022 Information Security Management System (ISMS), including certification and audit processes.

• Oversee information security risk assessments, regulatory compliance, and risk mitigation initiatives in accordance with OJK, Bank Indonesia, and applicable data protection regulations.

• Lead security operations, including SOC/SIEM, vulnerability management, and penetration testing, with hands-on involvement in security assessments and testing.

• Establish and maintain security controls across network, cloud infrastructure, applications, APIs, IAM/PAM, and cryptographic key management.

• Oversee information security for digital asset operations, including hot/cold wallets, HSM/MPC, key management, and transaction authorization.

• Drive Secure SDLC implementation in collaboration with Engineering and DevOps teams, ensuring security is integrated throughout system development and deployment.

• Lead cybersecurity incident response, business continuity, and disaster recovery initiatives.

• Manage internal and external IT audits, regulatory examinations, third-party security assessments, and remediation of audit findings.

• Build and lead the Information Security team, develop security awareness programs, and regularly report security posture and risk exposure to Directors and management.

Qualifications

• Bachelor's or Master's Degree in Information Technology, Computer Science, Information Systems, Cybersecurity, or a related field.

• Minimum 10 years of experience in IT, including at least 8 years in Information Security and 3–5 years in a managerial role.

• Mandatory experience in regulated financial services industries, such as banking, payment gateway/PJP, securities or futures exchanges, clearing and custody institutions, or crypto asset trading/exchange businesses.

• Strong understanding of financial services business processes, particularly crypto asset trading/exchange operations, and applicable regulatory requirements from OJK, Bank Indonesia, and Indonesia's Personal Data Protection Law (UU PDP).

• Proven experience in ISO/IEC 27001 implementation, regulatory audits/examinations, SOC operations, and cybersecurity incident management.

• Mandatory hands-on experience in conducting penetration testing and vulnerability assessments, including identifying vulnerabilities, assessing risks, and recommending remediation.

• Strong technical expertise in network security, cloud security (AWS/GCP/Azure), web and API security (OWASP), IAM/PAM, cryptography, SIEM, and security testing.

• Strong leadership, analytical, risk management, problem-solving, and stakeholder management skills.

• Proactive, independent, and capable of communicating technical security risks to Directors, regulators, and cross-functional teams.

• Willing to work fully onsite (WFO), be available for critical security incidents outside regular working hours, and undergo a background check.

Mandatory Professional Certification

Must hold at least one of the following:

• CISSP (ISC2)

• CISM (ISACA)

Preferred Certifications

• ISO/IEC 27001 Lead Implementer or Lead Auditor

• CISA or CRISC (ISACA)

• OSCP or GPEN (Offensive Security)

• GCIH, CCSP, PCIP, or CCSS Auditor