Section Head, Cyber Risk Management, Information Security Department

About the role

The Head of Section for Cyber Risk Management is responsible for leading and overseeing the Bank's cyber risk management function to ensure that cyber risks are systematically identified, assessed, monitored, and mitigated in accordance with Agrobank's risk appetite and regulatory expectations. The role provides strategic oversight and advisory to Management, Board Committees, and key stakeholders on the Bank's cyber risk posture, while ensuring compliance with applicable regulatory, industry, and best practice frameworks such as BNM RMiT, ISO 27001, and NIST. This position also drives the development of a strong cyber risk culture across the Bank and ensures effective governance, reporting, and continuous improvement of cyber risk management practices.

Key responsibilities

• Lead bank-wide cyber risk assessments, including identification, analysis, evaluation, and monitoring of cyber risks

• Oversee the development, implementation, and maintenance of cyber risk management frameworks, methodologies, and reporting

• Provide strategic cyber risk advisory to Management, Board Committees, and key stakeholders

• Oversee and govern cyber risk–related projects and initiatives, ensuring alignment with the Bank's cyber risk strategy, regulatory requirements, and risk appetite

• Coordinate cross-functional cyber risk projects involving Technology, Business Units, Compliance, Legal, and external parties to ensure timely and effective delivery

• Monitor progress, dependencies, and risks of cyber risk initiatives, and escalate issues to Management where necessary

• Champion cyber risk awareness and promote a risk-informed culture across the Bank

• Manage section resources, including performance management, training, and succession planning

• Ensure effective engagement with regulators, auditors, and external stakeholders on cyber risk matters

• Ensure cost-effective management of cyber risk initiatives and tools and support budget planning related to cyber risk activities

Qualifications & Requirements:

• At least 10 years of relevant experience in Cyber Security, Cyber Risk or Technology Risk Management, preferably in development banking and or relevant banking / financial environment

• A graduate degree in Information Technology, Cyber Security or other relevant major

• Professional certifications preferred (e.g. CISM, CRISC, CISSP)

• Exposure to technical and governance tasks e.g., security administrator, system, and network administrator

• Strong working knowledge of BNM Risk Management in Technology Policy Document

• Understanding relevant IT, security, operational and governance frameworks (e.g., ISO 27001, risk management, privacy by design)

• Leadership – Plan, organize, staff management, budget etc.

• Stakeholder management and decision making

• Cyber risk assessment methodologies and risk quantification

• Regulatory compliance (BNM RMiT, PDPA, MCIPD)