CISO – Hybrid FinTech Risk & Compliance

Doit; Petaling Jaya; Hybrid; MYR 180,000 - 280,000; Full time

Job summary

doit Holdings seeks a seasoned CISO to own information security and technology risk for its regulated investment platform in Malaysia. You will establish the risk framework, controls, monitoring, and evidence required for independent assessment prior to registration.

Responsibilities include overseeing daily technology risk, running security operations, incident response, and leading ISO/IEC 27001 certification efforts while coordinating with senior management and the board.

Qualifications

• 8+ years in information security, including 5+ in financial services or other regulated sectors.
• CISSP, CISM or CISA certification is required.
• Deep familiarity with SC's Guidelines on Technology Risk Management and its operationalisation.
• Experience with ISO/IEC 27001 implementation and certification.
• Hands-on operating style; able to review controls, run simulations and close gaps personally.

Responsibilities

• Hold board-appointed responsibility for day-to-day technology risk oversight and for delivering the board's cyber security strategy.
• Build the technology risk and cyber security frameworks, the risk appetite statement and the policy set beneath them.
• Run security operations across monitoring, vulnerability management, access control, data protection and secure development.
• Own incident response from detection through recovery and reporting to regulators on incident occurrence.
• Lead the platform through independent technology validation and achieve ISO/IEC 27001 certification.
• Deliver cyber security awareness program across the board, including senior management and staff.

Skills

InfoSec leadership

Risk management

Regulated sector

Cloud security

Incident response

Education

Computer science / IT degree

Tools

CISSP

CISM

CISA

ISO/IEC 27001 Lead Implementer

CCSP / CRISC

Job description

doit Holdings seeks a seasoned CISO to own information security and technology risk for its regulated investment platform in Malaysia. You will establish the risk framework, controls, monitoring, and evidence required for independent assessment prior to registration.

Responsibilities include overseeing daily technology risk, running security operations, incident response, and leading ISO/IEC 27001 certification efforts while coordinating with senior management and the board.