Head of Information Security

PT DARMAWAN ARYANSYAH TEKNOLOGI; Jakarta Selatan; On-site; IDR 600,000,000 - 1,000,000,000; Full time

Job summary

PT DARMAWAN ARYANSYAH TEKNOLOGI is seeking a seasoned Information Security leader to develop, implement, and maintain governance, risk, and compliance across our financial services operations in Indonesia.

You will drive ISO/IEC 27001:2022 ISMS, lead SOC, audits, incident response, and secure SDLC with Engineering and DevOps, manage audits, and build a high-performing security team reporting to directors.

Qualifications

• Must have 10+ years in IT with 8+ years in information security.
• Minimum 3–5 years in a managerial role.
• Experience in regulated financial services is mandatory.

Responsibilities

• Develop and implement information security strategies, policies, and procedures.
• Lead ISO/IEC 27001:2022 ISMS implementation and audits.
• Oversee risk assessments, regulatory compliance, and risk mitigation.
• Lead security operations including SOC/SIEM and vulnerability management.
• Drive Secure SDLC with Engineering and DevOps.
• Manage incident response, business continuity, and disaster recovery.
• Build and lead the Information Security team and report to Directors.

Skills

Security leadership

Regulatory compliance

Risk management

Penetration testing

Vulnerability assessment

ISO/IEC 27001

Cloud security

SOC/SIEM operations

Communication to directors

Education

Bachelor's or Master's in IT/CS/IS/Cybersecurity

Tools

SIEM

AWS/GCP/Azure

Job description

Develop and implement information security strategies, policies, standards, and procedures in alignment with business objectives and regulatory requirements.

Lead the implementation and maintenance of ISO/IEC 27001:2022 Information Security Management System (ISMS), including certification and audit processes.

Oversee information security risk assessments, regulatory compliance, and risk mitigation initiatives in accordance with OJK, Bank Indonesia, and applicable data protection regulations.

Lead security operations, including SOC/SIEM, vulnerability management, and penetration testing, with hands‑on involvement in security assessments and testing.

Establish and maintain security controls across network, cloud infrastructure, applications, APIs, IAM/PAM, and cryptographic key management.

Oversee information security for digital asset operations, including hot/cold wallets, HSM/MPC, key management, and transaction authorization.

Drive Secure SDLC implementation in collaboration with Engineering and DevOps teams, ensuring security is integrated throughout system development and deployment.

Lead cybersecurity incident response, business continuity, and disaster recovery initiatives.

Manage internal and external IT audits, regulatory examinations, third‑party security assessments, and remediation of audit findings.

Build and lead the Information Security team, develop security awareness programs, and regularly report security posture and risk exposure to Directors and management.

Qualifications

Bachelor's or Master's Degree in Information Technology, Computer Science, Information Systems, Cybersecurity, or a related field.

Minimum 10 years of experience in IT, including at least 8 years in Information Security and 3–5 years in a managerial role.

Mandatory experience in regulated financial services industries, such as banking, payment gateway/PJP, securities or futures exchanges, clearing and custody institutions, or crypto asset trading/exchange businesses.

Strong understanding of financial services business processes, particularly crypto asset trading/exchange operations, and applicable regulatory requirements from OJK, Bank Indonesia, and Indonesia's Personal Data Protection Law (UU PDP).

Proven experience in ISO/IEC 27001 implementation, regulatory audits/examinations, SOC operations, and cybersecurity incident management.

Mandatory hands‑on experience in conducting penetration testing and vulnerability assessments, including identifying vulnerabilities, assessing risks, and recommending remediation.

Strong technical expertise in network security, cloud security (AWS/GCP/Azure), web and API security (OWASP), IAM/PAM, cryptography, SIEM, and security testing.

Strong leadership, analytical, risk management, problem‑solving, and stakeholder management skills.

Proactive, independent, and capable of communicating technical security risks to Directors, regulators, and cross‑functional teams.

Willing to work fully onsite (WFO), be available for critical security incidents outside regular working hours, and undergo a background check.

Mandatory Professional Certification

Must hold at least one of the following:

CISSP (ISC2)

CISM (ISACA)

Preferred Certifications

ISO/IEC 27001 Lead Implementer or Lead Auditor

CISA or CRISC (ISACA)

OSCP or GPEN (Offensive Security)

GCIH, CCSP, PCIP, or CCSS Auditor

Unlock job insights

Hirer responsiveness Salary match Number of applicants

Researching careers? Find all the information and tips you need on career advice.