Head of IT Security

Hubexo; Jakarta Selatan; On-site; IDR 600,000,000 - 1,000,000,000; Full time

Job summary

Hubexo is seeking a hands-on Head of IT Security to own the security posture end-to-end amid a major technology migration. You will lead IT operations, IAM, incident response and vendor security, while embedding compliance across platforms and vendors.

You will collaborate with legal, procurement and engineering to ensure regulatory readiness, audits and security controls across Microsoft 365, cloud environments, and SaaS integrations.

Qualifications

• 8+ years in IT security and/or IT operations, incl. 3+ years leading security/IT function
• Proven experience delivering ISO 27001 certification and/or SOC 2 attestation, incl. external audits
• Hands-on with compliance automation platforms (Vanta preferred) and related tools
• Experience leading security incidents from identification to remediation and lessons learned
• Experience establishing vendor/third-party security assessment processes
• Experience scoping and managing penetration tests and driving remediation with engineering teams
• Experience managing outsourced SOC/MDR providers and SLAs
• Strong knowledge of Microsoft 365, Entra ID security, endpoints and cloud environments (AWS/Azure)
• Strong communication and stakeholder management, able to explain risks to non-technical audiences
• Experience in SaaS/tech/data-driven business, esp. during migrations/merger scenarios
• Familiarity with securing SaaS platforms like HubSpot, NetSuite, Chargebee, Make.com
• Understanding UK GDPR and cross-jurisdiction data protection
• Certifications like CISSP, CISM, ISO 27001 Lead Implementer/Auditor advantageous
• Cyber Essentials Plus or similar customer-driven security frameworks a plus

Responsibilities

• Define Hubexo's information security strategy, roadmap and risk management approach
• Report security posture, risks and compliance to senior leadership
• Build security awareness and manage budget, tooling and suppliers
• Oversee IT Operations: end-user computing, IAM, devices and core infrastructure
• Ensure secure-by-default configurations across M365, endpoints, networks and SaaS
• Manage IT service levels, patching, backup, recovery and onboarding of new systems
• Own incident response plans, playbooks and escalation processes
• Lead security incidents from triage to resolution and lessons learned
• Maintain business continuity and disaster recovery plans
• Lead ISO 27001 certification and SOC 2 attestation, including audits and remediation
• Own Vanta for compliance monitoring and control management
• Maintain ISMS and support customer security questionnaires and audits
• Lead vendor security assessments and engage Procurement/Legal on security requirements
• Track remediation and risk acceptance for third-party security issues
• Own penetration testing and vulnerability management programmes
• Manage external testing providers and drive remediation with tech teams
• Establish remediation priorities based on risk
• Manage external SOC provider, service levels and monitoring
• Review SOC reporting and improve detection
• Be the internal escalation point for SOC alerts and incidents

Skills

IT security

Security leadership

ISO 27001 & SOC 2

Vanta / compliance tools

Penetration testing

Vendor security assessments

SOC/MDR management

Microsoft 365 / Entra ID / AWS/Azure

Stakeholder communication

SaaS / data-driven business

Education

CISSP

CISM

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor

Tools

Vanta

Drata

Secureframe

Job description

About Hubexo

Hubexo is a global construction technology and data company, providing data, insights and software that help businesses across the construction industry work smarter, sell more and build better.

As Hubexo continues its transformation and migration towards a more unified operating model, we are looking for an experienced Head of IT Security to lead our security, IT operations and compliance agenda.

About the Role

As the Head of IT Security, you will own Hubexo's security posture end to end—from day-to-day IT operations and identity management to incident response, third‑party risk, penetration testing and compliance.

You will be the accountable leader for keeping Hubexo secure, audit‑ready and trusted by our customers.

This is a hands‑on leadership role. You will set the security strategy and roadmap, lead key programmes and work closely with senior stakeholders, while remaining close enough to the detail to lead an incident, challenge a vendor's security controls or review a penetration testing finding.

With Hubexo going through a major technology migration, you will also play a critical role in ensuring that new platforms, integrations, SaaS solutions and vendors are securely introduced, assessed and brought into compliance scope.

What We're Looking For

• 8+ years of experience in IT security and/or IT operations, including at least 3 years leading a security or IT function.

• Proven experience delivering ISO 27001 certification and/or SOC 2 attestation, including managing external audits.

• Hands‑on experience with a compliance automation platform, ideally Vanta. Experience with Drata or Secureframe is also relevant.

• Proven experience leading security incidents from identification and containment through to resolution and lessons learned.

• Experience establishing and managing a vendor or third‑party security assessment process.

• Experience scoping and managing penetration tests and driving remediation with engineering teams.

• Experience managing an outsourced SOC or MDR provider and managing performance against agreed service levels.

• Strong working knowledge of Microsoft 365, Entra ID security, endpoint management and cloud environments, particularly AWS or Azure.

• Strong communication and stakeholder management skills, with the ability to explain security risks clearly to non‑technical audiences and influence across the organisation.

• Experience working in a SaaS, technology or data‑driven business, ideally within a merger, integration or large‑scale platform migration.

• Familiarity with securing SaaS platforms and integrations such as HubSpot, NetSuite, Chargebee and Make.com.

• Good understanding of UK GDPR and data protection requirements across multiple jurisdictions.

• Relevant certifications such as CISSP, CISM, ISO 27001 Lead Implementer or Lead Auditor are advantageous.

• Experience with Cyber Essentials Plus or other customer‑driven security frameworks is a plus.

What You'll Do

Security Leadership & Strategy

• Define Hubexo's information security strategy, roadmap and risk management approach.

• Report security posture, risks and compliance to senior leadership.

• Build security awareness across the organisation and manage security budget, tooling and suppliers.

IT Operations

• Lead IT Operations across end‑user computing, identity and access management, devices and core infrastructure.

• Ensure secure‑by‑default configurations across Microsoft 365, endpoints, networks and SaaS platforms.

• Oversee IT service levels, patching, backup, recovery and secure onboarding of new systems.

Incident Response & Business Continuity

• Own incident response plans, playbooks and escalation processes.

• Lead security incidents from triage through to resolution, root cause analysis and lessons learned.

• Maintain business continuity and disaster recovery plans and coordinate regulatory response where required.

ISO 27001 & SOC 2

• Lead ISO 27001 certification and SOC 2 attestation, including audits, controls and remediation.

• Own Vanta for compliance monitoring, evidence collection and control management.

• Maintain the ISMS and support customer security questionnaires and audits.

Third‑Party & Vendor Security

• Lead vendor security assessments and review security certifications, reports and questionnaires.

• Partner with Procurement and Legal on security and data protection requirements.

• Track remediation and risk acceptance for third‑party security issues.

Penetration Testing & Vulnerability Management

• Own the penetration testing and vulnerability management programmes.

• Manage external testing providers and drive remediation with technology teams.

• Establish clear remediation priorities and timelines based on risk.

External SOC Partnership

• Manage the external SOC provider, including service levels, monitoring coverage and escalations.

• Review SOC reporting, improve detection and ensure new systems are appropriately monitored.

• Act as the internal escalation point for SOC alerts and incidents.

Why Join Hubexo?

This is an opportunity to take ownership of a broad and highly visible security agenda within a global technology business.

You will have the opportunity to shape Hubexo's security strategy, strengthen our IT operating model and build security capabilities that support the company's continued transformation and growth.

If you're a security leader who enjoys combining strategy with hands‑on execution, working across technology and business teams, and building security into a fast‑changing environment, we'd love to hear from you.