Head of IT Security

Hubexo; Jakarta Pusat; Vor Ort; IDR 1.200.000.000 - 1.800.000.000; Vollzeit

Zusammenfassung

Hubexo is seeking a hands-on Head of IT Security in Jakarta to own our security posture end to end—covering day-to-day IT operations, identity management, incident response and third-party risk. You will be the accountable leader for audit readiness and customer trust.

In this leadership role you’ll define the security strategy and roadmap, manage audits (ISO 27001 / SOC 2), oversee vendor security, penetration testing, and external SOCs, and drive secure platform migrations across the business.

Qualifikationen

• 8+ years in IT security and/or IT operations, including at least 3 years leading a security/IT function.
• ISO 27001 certification and/or SOC 2 attestation experience.
• Hands-on with compliance automation platforms (Vanta preferred).
• Experience leading security incidents from identification to resolution.
• Experience establishing vendor/third-party security assessments.

Aufgaben

• Define Hubexo's information security strategy, roadmap and risk management approach.
• Report security posture, risks and compliance to senior leadership.
• Build security awareness and manage budget, tooling and suppliers.
• Lead IT Operations across end-user computing, identity and access management, devices and core infrastructure.
• Ensure secure-by-default configurations across Microsoft 365, endpoints, networks and SaaS platforms.
• Oversee IT service levels, patching, backup, recovery and secure onboarding of new systems.
• Own incident response plans, playbooks and escalation processes.
• Lead ISO 27001 certification and SOC 2 attestation, including audits and remediation.
• Lead vendor security assessments and coordinate with Procurement and Legal.
• Oversee penetration testing and vulnerability management with external providers.

Kenntnisse

Security leadership

ISO 27001

SOC 2

Incident response

Vendor security assessments

Penetration testing

SOC/MDR management

Cloud and identity security

Stakeholder management

SaaS security

SaaS integrations

Data protection & GDPR

CISSP/CISM

Cyber Essentials Plus

Tools

Vanta

Drata

Secureframe

Jobbeschreibung

About Hubexo

Hubexo is a global construction technology and data company, providing data, insights and software that help businesses across the construction industry work smarter, sell more and build better.

About the Role

As the Head of IT Security, you will own Hubexo's security posture end to end-from day-to-day IT operations and identity management to incident response, third-party risk, penetration testing and compliance.

You will be the accountable leader for keeping Hubexo secure, audit-ready and trusted by our customers.

This is a hands-on leadership role. You will set the security strategy and roadmap, lead key programmes and work closely with senior stakeholders, while remaining close enough to the detail to lead an incident, challenge a vendor's security controls or review a penetration testing finding.

With Hubexo going through a major technology migration, you will also play a critical role in ensuring that new platforms, integrations, SaaS solutions and vendors are securely introduced, assessed and brought into compliance scope.

What We're Looking For

• 8+ years of experience in IT security and/or IT operations, including at least 3 years leading a security or IT function.

• Proven experience delivering ISO 27001 certification and/or SOC 2 attestation, including managing external audits.

• Hands-on experience with a compliance automation platform, ideally Vanta. Experience with Drata or Secureframe is also relevant.

• Proven experience leading security incidents from identification and containment through to resolution and lessons learned.

• Experience establishing and managing a vendor or third-party security assessment process.

• Experience scoping and managing penetration tests and driving remediation with engineering teams.

• Experience managing an outsourced SOC or MDR provider and managing performance against agreed service levels.

• Strong working knowledge of Microsoft 365, Entra ID security, endpoint management and cloud environments, particularly AWS or Azure.

• Strong communication and stakeholder management skills, with the ability to explain security risks clearly to non-technical audiences and influence across the organisation.

• Experience working in a SaaS, technology or data-driven business, ideally within a merger, integration or large-scale platform migration.

• Familiarity with securing SaaS platforms and integrations such as HubSpot, NetSuite, Chargebee and Make.com.

• Good understanding of UK GDPR and data protection requirements across multiple jurisdictions.

• Relevant certifications such as CISSP, CISM, ISO 27001 Lead Implementer or Lead Auditor are advantageous.

• Experience with Cyber Essentials Plus or other customer-driven security frameworks is a plus.

What You'll Do

Security Leadership & Strategy

• Define Hubexo's information security strategy, roadmap and risk management approach.

• Report security posture, risks and compliance to senior leadership.

• Build security awareness across the organisation and manage security budget, tooling and suppliers.

IT Operations

• Lead IT Operations across end-user computing, identity and access management, devices and core infrastructure.

• Ensure secure-by-default configurations across Microsoft 365, endpoints, networks and SaaS platforms.

• Oversee IT service levels, patching, backup, recovery and secure onboarding of new systems.

Incident Response & Business Continuity

• Own incident response plans, playbooks and escalation processes.

• Lead security incidents from triage through to resolution, root cause analysis and lessons learned.

• Maintain business continuity and disaster recovery plans and coordinate regulatory response where required.

ISO 27001 & SOC 2

• Lead ISO 27001 certification and SOC 2 attestation, including audits, controls and remediation.

• Own Vanta for compliance monitoring, evidence collection and control management.

• Maintain the ISMS and support customer security questionnaires and audits.

Third-Party & Vendor Security

• Lead vendor security assessments and review security certifications, reports and questionnaires.

• Partner with Procurement and Legal on security and data protection requirements.

• Track remediation and risk acceptance for third-party security issues.

Penetration Testing & Vulnerability Management

• Own the penetration testing and vulnerability management programmes.

• Manage external testing providers and drive remediation with technology teams.

• Establish clear remediation priorities and timelines based on risk.

External SOC Partnership

• Manage the external SOC provider, including service levels, monitoring coverage and escalations.

• Review SOC reporting, improve detection and ensure new systems are appropriately monitored.

• Act as the internal escalation point for SOC alerts and incidents.

Why Join Hubexo?

This is an opportunity to take ownership of a broad and highly visible security agenda within a global technology business.

You will have the opportunity to shape Hubexo's security strategy, strengthen our IT operating model and build security capabilities that support the company's continued transformation and growth.

If you're a security leader who enjoys combining strategy with hands-on execution, working across technology and business teams, and building security into a fast-changing environment, we'd love to hear from you.