IT Security Governance

About the role

IT Security Governance role supporting the IT Security Team Lead in planning, maintaining and tracking the IT Security Roadmap aligned with recognized frameworks (NIST CSF, ISO/IEC 27001) and business objectives. The role encompasses security governance, policy management, risk assessment, compliance, audit coordination, process controls, security awareness programs, data security initiatives, and stakeholder coordination across the organization.

Key responsibilities

• Support the IT Security Team Lead in planning, maintaining and tracking the IT Security Roadmap, aligned with recognized frameworks (NIST CSF, ISO/IEC 27001) and business objectives

• Establish, review and update IT Security Policies, Regulations, Standards and Procedures; identify security domain gaps against NIST / ISO 27001; and drive policy announcement and acknowledgement across companies

• Coordinate IT security risk assessments (including updating the risk assessment questionnaire to the latest ISO 27001), third-party and dealer security assessments, and follow up risk acceptance and remediation plans until closure

• Act as the focal point for internal and external IT security audits; prepare evidence and follow up audit findings with responsible teams until fully closed

• Establish and operate IT security process controls and quality checks to verify that approved IT Security Regulations and controls are implemented correctly and remain effective

• Plan and execute the annual security awareness program, including e-IT Security learning, phishing simulations (3 times/year), table-top exercises (e.g., PDPA, incident response), awareness for the IT team, and dealer/branch security

• Develop awareness materials, the monthly IT Security Newsletter and threat news; deliver training and provide ad-hoc consultation on IT Security Regulations to staff and companies

• Support data protection initiatives such as Google DLP implementation, data classification and PDPA-related controls

• Collaborate with system owners, Infra/App Security teams, business units, dealers and external consultants to resolve issues and implement permanent solutions to prevent recurring problems

• Define and monitor KPIs (e.g., phishing click rate, training completion, policy compliance, audit findings closure) and report status to the IT Security Team Lead and management in a timely manner

About you

• Knowledge of IT security governance frameworks and standards (e.g., ISO/IEC 27001, NIST CSF) and Thai PDPA

• Experience in drafting and reviewing IT security policies, regulations, standards and procedures

• Understanding of IT risk assessment, IT security controls and the IT audit process (evidence preparation, findings follow-up)

• Knowledge of security awareness practices such as phishing simulation, social engineering, e-learning and table-top exercises

• Knowledge of data security / data protection (e.g., DLP, data classification)

• Basic understanding of infrastructure and application security (network, cloud, endpoint, web application) to communicate with technical teams

• Security certifications ISC2 CC or CompTIA Security+ as minimum

• Strong communication and presentation skills; able to explain security to non-technical audiences

• Good collaboration and stakeholder management across business units, IT teams and dealers

• Detail-oriented, systematic and well-organized