InfoSec Lead: Compliance, Risk & Incident Response

FAZZ, Inc.; Indonesia; Hybrid; IDR 300,000,000 - 600,000,000; Full time

Job summary

FAZZ, Inc. in Indonesia seeks a Security & Compliance Lead to own audit readiness, governance and risk across the organization. You will oversee policy development, control evidence, vulnerability testing, and regulatory obligations (OJK, Bank Indonesia, UU PDP, PCI-DSS, ISO 27001, SOC 2).

You will drive security operations, vulnerability management, access controls, secure SDLC, vendor risk and incident response. Strong cross-functional collaboration is essential.

Responsibilities

• Compliance, governance & audit readiness: Own audit documentation across all entities — policies, procedures, control evidence, risk registers, and remediation records; plan and perform security tests and capture evidence required by auditors; maintain compliance with regulatory and standards frameworks; serve as primary contact for auditors and regulators; develop and enforce security policies and standards across all functions and entities.
• Security operations: Monitor systems and transactions; run security tooling; lead incident response and regulatory breach notification.
• Vulnerability management: Scan, patch, and coordinate pen tests; track fixes to closure.
• Access & identity: Enforce least-privilege, MFA, PAM, and segregation of duties around funds and production data.
• Application & infrastructure security: Harden systems and cloud; manage encryption and secure baselines; embed security into each team's SDLC.
• Risk management: Run risk assessments; vet vendors; advise on secure product design.
• Awareness & resilience: Train staff; run phishing simulations; support disaster recovery and business continuity.

Job description

FAZZ, Inc. in Indonesia seeks a Security & Compliance Lead to own audit readiness, governance and risk across the organization. You will oversee policy development, control evidence, vulnerability testing, and regulatory obligations (OJK, Bank Indonesia, UU PDP, PCI-DSS, ISO 27001, SOC 2).

You will drive security operations, vulnerability management, access controls, secure SDLC, vendor risk and incident response. Strong cross-functional collaboration is essential.