Head of IT Security

PT Media Indonusa (Jakarta); Jakarta Utara; On-site; IDR 900,000,000 - 1,300,000,000; Full time

Job summary

PT Media Indonusa (Jakarta) seeks a Head of IT Security to lead the information security function across GRC, Security Engineering, and MIS, shaping policies and controls. You will drive PCI-DSS compliance, ISO/IEC 27001 alignment, risk management, and incident governance while integrating security into IT operations and payments environment.

This leadership role demands a decade in security with at least 3 years in a head role, plus strong communication with management and hands-on

Qualifications

• Minimum 10 years in information security or IT
• At least 3 years in a security leadership role
• Experience leading multiple functions (GRC, security engineering, and/or IT operations)
• Experience in financial services, banking, or payment service providers
• Proven PCI-DSS compliance experience and audit support
• Experience developing information security policies and implementing CIS Benchmarks, ISO/IEC 27001, NIST
• Experience leading security investigations and incident governance
• Technical understanding of cloud, containers/Kubernetes, and payment app architecture

Responsibilities

• Lead IT GRC, IT Security Engineering, and MIS as an integrated function
• Establish and update information security policies and baselines
• Maintain technology risk register and regulatory compliance (PCI-DSS)
• Coordinate security audits and third-party assessments
• Design and oversee technical security controls
• Build monitoring, detection, and alerting for unusual activity (incl. funds)
• Oversee internal IT services (helpdesk, devices, networks, email)
• Manage access controls during onboarding, role changes, and terminations

Skills

GRC

Security leadership

Multi-team leadership

PCI-DSS

Policy development

Risk management

ISO 27001

NIST

Cloud

Kubernetes

Incident governance

Job description

Head of IT Security will lead the company's information security function comprehensively. This position oversees 3 functions: IT Governance, Risk & Compliance (GRC), IT Security Engineering, and Management Information System (MIS). The role is responsible for establishing security policies, ensuring compliance with industry standards, overseeing implementation of technical controls, and managing the company's internal information technology operations. The selected Head of IT Security will lead the company's security and compliance strengthening program to completion, building a solid and structured information security function for the company going forward.

Key responsibilities

Lead, develop, and manage IT GRC, IT Security Engineering, and MIS teams as an integrated information security function

Establish, set, and update company information security policies, including standards for secrets management, access control, and configuration baseline (CIS Benchmarks, ISO/IEC 27001)

Maintain and regularly review a technology risk register

Ensure and monitor company compliance with PCI-DSS and applicable regulatory requirements for payment service providers

Conduct and coordinate security audits and compliance testing by independent third parties on a regular basis

Design and oversee implementation of technical security controls across the company environment, including secrets management systems, multi-factor authentication, and access segmentation

Build and manage capabilities for monitoring, detection, and alerting on unusual activity on company systems, including fund transfer transactions

Conduct continuous vulnerability management, including regular scanning and coordination of penetration testing

Manage the entire company's internal information technology services, including user support (helpdesk), employee devices, office networks, and email and collaboration systems

Establish and enforce procedures for granting, changing, and revoking employee access rights at onboarding, role changes, and employment termination

Job Requirements

Minimum 10 years of experience in information security or information technology, with at least 3 years in a security leadership role (Head of Security, CISO, IT Security Manager, or equivalent)

Experience leading multiple functions simultaneously (multi-team leadership), ideally including a combination of GRC, security engineering, and/or IT operations

Direct experience in the financial services, banking, or payment service provider industry regulated by Bank Indonesia and/or the Financial Services Authority

Proven experience leading and maintaining PCI-DSS compliance, including audit preparation and support

Experience developing information security policies and implementing recognized frameworks (CIS Benchmarks, ISO/IEC 27001, NIST)

Experience leading real security investigations and incident governance

Adequate technical understanding of cloud, containers/Kubernetes, and payment application architecture to oversee technical control implementation by the Security Engineering team

Ability to communicate technical risks to management clearly and firmly