Head of IT Security

PT Hubexo Asia Indonesia; Jakarta Utara; On-site; IDR 600,000,000 - 1,800,000,000; Full time

Benefits offered by this job

Medical

Sports

Vision

Miscellaneous allowance

Parking

Annual Leave

Birthday Leave

Charity Day Leave

Job summary

Hubexo is seeking an experienced Head of IT Security to lead security, IT operations and compliance across the business. This hands‑on leadership role will set the security strategy and roadmap, drive risk management and coordinate ISO 27001 and SOC 2 audits, while overseeing vendor security, incident response and cloud security across AWS and Azure.

You will work with senior stakeholders, build security awareness, manage budgets and ensure secure‑by‑default configurations across Microsoft 365,

Qualifications

• 8+ years of IT security and IT operations experience.
• At least 3 years in a security or IT leadership role.
• Experience delivering ISO 27001 certification and/or SOC 2 attestation.
• Hands-on with a compliance automation platform (Vanta preferred).
• Proven in leading security incidents from detection to resolution.
• Experience managing third-party security assessments.
• Experience scoping and managing penetration tests and remediation.
• Experience managing an outsourced SOC or MDR provider.
• Strong knowledge of Microsoft 365, Entra ID, endpoints and cloud (AWS/Azure).
• Excellent communication and stakeholder management.

Responsibilities

• Define Hubexo's information security strategy, roadmap and risk management approach.
• Report security posture, risks and compliance to senior leadership.
• Build security awareness and manage security budget, tooling and suppliers.
• Lead IT Operations across end‑user computing, identity and access management, devices and core infrastructure.
• Ensure secure‑by‑default configurations across Microsoft 365, endpoints and SaaS platforms.
• Oversee IT service levels, patching, backup and secure onboarding of new systems.
• Own incident response plans, playbooks and escalation processes.
• Lead security incidents from triage to root cause analysis and lessons learned.
• Lead ISO 27001 certification and SOC 2 attestation, including audits and remediation.
• Own Vanta for compliance monitoring, evidence collection and control management.
• Maintain ISMS and support customer security questionnaires and audits.
• Lead vendor security assessments and collaborate with Procurement/Legal.
• Track remediation and risk acceptance for third‑party security issues.
• Own penetration testing and vulnerability management programmes.
• Manage external testing providers and drive remediation with tech teams.
• Establish clear remediation priorities and timelines based on risk.
• Manage external SOC provider, SLAs, monitoring and escalations.

Skills

Security leadership

Incident response

Vendor security

ISO 27001

SOC 2

Risk management

M365

Cloud security

Entra ID

Audits

Tools

Vanta

Drata

Secureframe

Job description

Hubexo is a global construction technology and data company, providing data, insights and software that help businesses across the construction industry work smarter, sell more and build better.

As Hubexo continues its transformation and migration towards a more unified operating model, we are looking for an experienced Head of IT Security to lead our security, IT operations and compliance agenda.

About the Role

As the Head of IT Security, you will own Hubexo's security posture end to end—from day-to-day IT operations and identity management to incident response, third-party risk, penetration testing and compliance.

You will be the accountable leader for keeping Hubexo secure, audit-ready and trusted by our customers.

This is a hands-on leadership role. You will set the security strategy and roadmap, lead key programmes and work closely with senior stakeholders, while remaining close enough to the detail to lead an incident, challenge a vendor's security controls or review a penetration testing finding.

With Hubexo going through a major technology migration, you will also play a critical role in ensuring that new platforms, integrations, SaaS solutions and vendors are securely introduced, assessed and brought into compliance scope.

What We're Looking For

8+ years of experience in IT security and/or IT operations, including at least 3 years leading a security or IT function.

Proven experience delivering ISO 27001 certification and/or SOC 2 attestation, including managing external audits.

Hands‑on experience with a compliance automation platform, ideally Vanta. Experience with Drata or Secureframe is also relevant.

Proven experience leading security incidents from identification and containment through to resolution and lessons learned.

Experience establishing and managing a vendor or third‑party security assessment process.

Experience scoping and managing penetration tests and driving remediation with engineering teams.

Experience managing an outsourced SOC or MDR provider and managing performance against agreed service levels.

Strong working knowledge of Microsoft 365, Entra ID security, endpoint management and cloud environments, particularly AWS or Azure.

Strong communication and stakeholder management skills, with the ability to explain security risks clearly to non‑technical audiences and influence across the organisation.

Experience working in a SaaS, technology or data‑driven business, ideally within a merger, integration or large‑scale platform migration.

Familiarity with securing SaaS platforms and integrations such as HubSpot, NetSuite, Chargebee and Make.com.

Good understanding of UK GDPR and data protection requirements across multiple jurisdictions.

Relevant certifications such as CISSP, CISM, ISO 27001 Lead Implementer or Lead Auditor are advantageous.

Experience with Cyber Essentials Plus or other customer‑driven security frameworks is a plus.

What You'll Do

Security Leadership & Strategy

Define Hubexo's information security strategy, roadmap and risk management approach.

Report security posture, risks and compliance to senior leadership.

Build security awareness across the organisation and manage security budget, tooling and suppliers.

IT Operations

Lead IT Operations across end‑user computing, identity and access management, devices and core infrastructure.

Ensure secure‑by‑default configurations across Microsoft 365, endpoints, networks and SaaS platforms.

Oversee IT service levels, patching, backup, recovery and secure onboarding of new systems.

Incident Response & Business Continuity

Own incident response plans, playbooks and escalation processes.

Lead security incidents from triage through to resolution, root cause analysis and lessons learned.

Maintain business continuity and disaster recovery plans and coordinate regulatory response where required.

ISO 27001 & SOC 2

Lead ISO 27001 certification and SOC 2 attestation, including audits, controls and remediation.

Own Vanta for compliance monitoring, evidence collection and control management.

Maintain the ISMS and support customer security questionnaires and audits.

Third‑Party & Vendor Security

Lead vendor security assessments and review security certifications, reports and questionnaires.

Partner with Procurement and Legal on security and data protection requirements.

Track remediation and risk acceptance for third‑party security issues.

Penetration Testing & Vulnerability Management

Own the penetration testing and vulnerability management programmes.

Manage external testing providers and drive remediation with technology teams.

Establish clear remediation priorities and timelines based on risk.

External SOC Partnership

Manage the external SOC provider, including service levels, monitoring coverage and escalations.

Review SOC reporting, improve detection and ensure new systems are appropriately monitored.

Act as the internal escalation point for SOC alerts and incidents.

Why Join Hubexo?

This is an opportunity to take ownership of a broad and highly visible security agenda within a global technology business.

You will have the opportunity to shape Hubexo's security strategy, strengthen our IT operating model and build security capabilities that support the company's continued transformation and growth.

If you're a security leader who enjoys combining strategy with hands‑on execution, working across technology and business teams, and building security into a fast‑changing environment, we'd love to hear from you.

Perks and benefits

• Medical
• Sports (e.g. Gym)
• Vision
• Miscellaneous allowance
• Parking
• Annual Leave
• Birthday Leave
• Charity Day Leave