IT Security Officer

Fazz; Indonesia; On-site; IDR 420,000,000 - 660,000,000; Full time

Job summary

Fazz is seeking a Security & Compliance lead in Indonesia to own audit documentation, monitor security operations, and drive remediation across entities. The role requires coordinating vulnerability testing, enforcing access controls, and embedding security into the SDLC.

You will manage risk assessments, vendor vetting, training, and incident response, ensuring regulatory alignment and timely audits.

Qualifications

• Experience ensuring compliance with industry standards and regulations.
• Ability to run security tests and coordinate remediation.
• Strong understanding of access control and identity management.

Responsibilities

• Own audit documentation across entities: policies, procedures, control evidence, risk registers, remediation records.
• Plan and perform security tests (vulnerability scans, pen tests) with evidence for auditors.
• Maintain compliance with regulatory standards and serve as audit contact.
• Drive findings to closure and enforce security policies across functions.
• Monitor security operations, respond to incidents, and coordinate breach notifications.
• Lead vulnerability management: patching and risk tracking.
• Enforce least-privilege, MFA, PAM, and segregation of duties around funds.
• Embed security into SDLC and manage encryption baselines.

Skills

Audit readiness

Security operations

Vulnerability management

Access & identity

Application security

Infrastructure security

Risk assessments

Awareness & resilience

Job description

• Compliance, governance & audit readiness (primary focus, current bottleneck): Own audit documentation across all entities — policies, procedures, control evidence, risk registers, and remediation records, kept audit-ready at all times; plan and perform security tests (vulnerability scans, penetration tests, control testing) and capture the evidence auditors require; maintain compliance with OJK, Bank Indonesia, UU PDP, PCI-DSS, ISO 27001, and SOC 2; serve as primary contact for internal/external auditors and regulators, driving findings to closure; develop and enforce security policies and standards across all functions and entities.
• Security operations: Monitor systems and transactions across functions and entities; run security tooling; lead incident response and regulatory breach notification.
• Vulnerability management: Scan, patch, and coordinate pen tests; track fixes to closure.
• Access & identity: Enforce least-privilege, MFA, PAM, and segregation of duties around funds and production data.
• Application & infrastructure security: Harden systems and cloud; manage encryption and secure baselines; embed security into each team's SDLC.
• Risk management: Run risk assessments; vet vendors and third-party integrations; advise on secure product design.
• Awareness & resilience: Train staff across functions and entities; run phishing simulations; support disaster recovery and business continuity.