IT Security Governance
Summary
IT Security Governance specialist at Phillip Life Assurance in Bangkok, reporting to the Head of IT Services and Governance. Day to day: maintain security policies and ISMS (ISO 27001/NIST compliance), coordinate IT audits and OIC regulatory submissions, run VA/penetration testing and hardening reviews, deliver security awareness training, and handle security incident response.
About the role
IT Security Governance role reporting to Head of IT Services and Governance within the Information Technology department. The role encompasses security governance and ISMS management, IT audit and regulatory compliance, cybersecurity awareness and training, vulnerability assessment and penetration testing, security operations, and security incident response.
Key responsibilities
Develop and maintain IT Security Governance frameworks, policies, standards, and procedures to support business objectives and regulatory requirements
Manage the IT documentation lifecycle, including IT policy and procedure announcement, version control, and periodic review to ensure documents remain current and compliant
Facilitate IT governance assessments against ISO 27001, NIST, and other relevant frameworks, translating control gaps into practical remediation roadmaps
Execute and coordinate the company's ISO 27001 certification work plan - coordinate gap analysis, implementation, and audit readiness
Coordinate internal and external IT audits, ensuring timely remediation of audit findings and compliance gaps
Support plan and document in preparing to OIC audit finding- including Annual OIC IT Audit, CRAF, IT Environment Survey, and Electronic Registration and Certificate requirements
Design and deliver security awareness and phishing simulation programs for all staff
Independently execute VA and Penetration Testing activities for servers, network infrastructure, applications, databases and other IT assets
Execute security hardening and configuration reviews for Windows/Linux servers, network devices, security appliances and other infrastructure components based on security baselines and industry best practices
Manage and respond to security alerts, incidents, and breaches from SOC
About you
Experience in IT Security Governance, Cybersecurity, IT Risk Management, or related roles
Strong understanding of security frameworks such as ISO 27001, NIST, COBIT, or related standards
Experience with security policies, compliance, risk assessment, and audit processes
Experience in the banking, financial services, or regulated industries is highly preferred
The Company reserves the right not to consider any candidate application or profile submitted by any recruitment agency without prior request, approval, or authorization from the Company, notwithstanding any existing service agreement between the parties. Any unsolicited candidate submission shall not create any obligation or liability whatsoever on the part of the Company. Should any recruitment agency wish to introduce candidates or discuss potential collaboration, please contact 095-3727982 directly prior to taking any action.