Head, Cyber Security

KPJ Healthcare Berhad; Kuala Lumpur; On-site; MYR 700,000 - 1,000,000; Full time

Job summary

KPJ Healthcare Berhad seeks a Head of Cyber Security to provide strategic leadership and governance over the Group's cybersecurity posture across hospitals, clinical environments and digital platforms.

The role drives cybersecurity strategy, operations, risk management, compliance and security transformation while protecting patient data and critical healthcare systems, reporting to executive and board-level stakeholders.

Qualifications

• Bachelor's degree in Cybersecurity, IT, CS or related field.
• CISSP/CISM/CRISC certifications advantageous.
• 10–15 years in cybersecurity with at least 5 years in leadership.
• Experience in healthcare IT environments (HIS, devices, data privacy).
• Experience in SOC operations, incident response, and cyber crisis management.

Responsibilities

• Define, lead and execute the Group-wide cybersecurity strategy and roadmaps.
• Oversee SOC, threat intel, vulnerability mgmt, and incident response.
• Ensure compliance with PDPA, ISO 27001, NIST, and healthcare regulations.
• Champion security-by-design across digital initiatives and architectures.
• Manage third-party security risk and cybersecurity budget.

Skills

CISSP

CISM

CRISC

Leadership

Stakeholder mgmt

Strategic thinking

Communication skills

Education

Bachelor's degree

Master's preferred

Job description

The Head, Cyber Security is responsible for providing strategic leadership, governance, and oversight of the Group's cybersecurity posture across hospitals, clinical environments, and digital platforms. This role will lead cybersecurity strategy, operations, risk management, compliance, and security transformation initiatives while safeguarding patient data and critical healthcare systems.

Key responsibilities

Strategic Leadership & Governance

Define, lead, and execute the Group-wide cybersecurity strategy and multi-year roadmap aligned with business objectives.

Establish and maintain the Group's cybersecurity risk appetite, ensuring alignment with enterprise risk management.

Provide regular cyber risk reporting and advisory to KPJ Management, CDO, and Board-level stakeholders.

Develop and enforce cybersecurity policies, standards, and governance frameworks across all entities.

Cybersecurity Operations & Resilience

Oversee end-to-end cybersecurity operations including SOC, threat intelligence, vulnerability management, and incident response.

Lead major cybersecurity incidents and crisis management, ensuring effective response, communication, and recovery.

Ensure continuous improvement of detection, response, and recovery capabilities across hospitals.

Regulatory Compliance & Risk Management

Ensure compliance with healthcare regulations, data protection laws (e.g. PDPA), and relevant cybersecurity standards.

Drive risk assessments across clinical systems, infrastructure, and third-party environments.

Lead internal and external audits related to cybersecurity and ensure timely remediation of findings.

Digital Transformation & Security Engineering

Champion security-by-design principles across all digital initiatives, including HIS, cloud platforms, and AI/analytics use cases.

Partner with technology and business teams to embed cybersecurity into system architecture and project lifecycles.

Ensure secure adoption of emerging technologies while balancing innovation and risk.

Third-Party & Vendor Management

Own and manage key cybersecurity vendor relationships, including managed SOC, security tooling, and consulting partners.

Establish and enforce third-party security risk management practices across the Group.

Manage cybersecurity budget, ensuring optimal allocation of resources and cost-effective investments.

Drive capability development, awareness, and a strong security culture across the organization.

Requirements

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or related field (Master's preferred but not mandatory).

Professional certifications such as CISSP, CISM, CRISC, or equivalent are highly advantageous.

Minimum 10-15 years of experience in cybersecurity, with at least 5 years in a leadership role.

Proven track record in developing and implementing enterprise cybersecurity strategies.

Strong understanding of healthcare IT environments, including clinical systems (HIS), medical devices, and data privacy requirements.

Experience managing SOC operations, incident response, and cyber crisis management.

Familiarity with regulatory frameworks such as PDPA, ISO 27001, NIST, and healthcare-specific requirements.

Strong leadership and stakeholder management skills, with the ability to influence at executive and board levels.

Strategic thinking with the ability to translate risk into business impact.

Excellent communication skills, particularly in articulating cybersecurity risks to non-technical stakeholders.

Decision-making under pressure, especially during incidents or crises.

Vendor and contract management expertise.

Your application will include the following questions:

• Which of the following statements best describes your right to work in Malaysia?

Healthcare Services More than 10,000 employees

KPJ Healthcare Berhad is the leading provider of private healthcare services in Malaysia, with a history dating back to 1981 when it introduced the first private specialist hospital in Johor. The Group's core values of Safety, Courtesy, Integrity, Professionalism, and Continuous Improvement drive its integrated network of more than 29 specialist hospitals across Malaysia. Additionally, KPJ has expanded its presence internationally, with hospitals in Indonesia, Bangkok, and Bangladesh, as well as investments in retirement and age-care resorts in Australia and Malaysia.

KPJ's competitive advantage stems from its extensive reach and accessibility throughout the nation, offering a wide range of medical specialist services, some of which are pioneering in the country's healthcare industry. The company also excels in utilizing integrated technology to enhance patient care, including the adoption of Cloud Computing and continuous improvements to the KPJ Clinical Information System (KCIS). Furthermore, KPJ is exploring digitalized medical technology applications in areas such as E-Pharmacy, wearable technology, robotics, Artificial Intelligence (AI), and the Internet of Things (IoT).

With over three and a half decades of experience in hospital development and management, KPJ is built on strong fundamentals, positioning it well for the evolving healthcare industry. The company's health tourism segment has experienced significant growth through aggressive marketing strategies, expanding its footprint in various regions.

In addition to hospital-based care, KPJ has made strides in healthcare-related industries, particularly in KPJ Senior Living Care services and Healthcare Education, recognizing their potential for the future due to increasing consumer demand. KPJ hospitals have received recognition from accreditation bodies, ensuring the quality and safety of their services.

The company is committed to giving back to the community and has established a network of Klinik Wakaf An-Nur (KWAN) charity clinics and a Hospital Waqaf An-Nur (HWAN) to provide care to the underprivileged. With 18 KWAN clinics and five mobile clinics, KPJ's efforts have positively impacted over one million patients since 1998.

Overall, KPJ Healthcare Berhad's extensive network, commitment to innovation, and dedication to quality healthcare services and community outreach make it a prominent and trusted player in the private healthcare industry.

KPJ Healthcare Berhad is the leading provider of private healthcare services in Malaysia, with a history dating back to 1981 when it introduced the first private specialist hospital in Johor. The Group's core values of Safety, Courtesy, Integrity, Professionalism, and Continuous Improvement drive its integrated network of more than 29 specialist hospitals across Malaysia. Additionally, KPJ has expanded its presence internationally, with hospitals in Indonesia, Bangkok, and Bangladesh, as well as investments in retirement and age-care resorts in Australia and Malaysia.

KPJ's competitive advantage stems from its extensive reach and accessibility throughout the nation, offering a wide range of medical specialist services, some of which are pioneering in the country's healthcare industry. The company also excels in utilizing integrated technology to enhance patient care, including the adoption of Cloud Computing and continuous improvements to the KPJ Clinical Information System (KCIS). Furthermore, KPJ is exploring digitalized medical technology applications in areas such as E-Pharmacy, wearable technology, robotics, Artificial Intelligence (AI), and the Internet of Things (IoT).

With over three and a half decades of experience in hospital development and management, KPJ is built on strong fundamentals, positioning it well for the evolving healthcare industry. The company's health tourism segment has experienced significant growth through aggressive marketing strategies, expanding its footprint in various regions.

In addition to hospital-based care, KPJ has made strides in healthcare-related industries, particularly in KPJ Senior Living Care services and Healthcare Education, recognizing their potential for the future due to increasing consumer demand. KPJ hospitals have received recognition from accreditation bodies, ensuring the quality and safety of their services.

The company is committed to giving back to the community and has established a network of Klinik Wakaf An-Nur (KWAN) charity clinics and a Hospital Waqaf An-Nur (HWAN) to provide care to the underprivileged. With 18 KWAN clinics and five mobile clinics, KPJ's efforts have positively impacted over one million patients since 1998.

Overall, KPJ Healthcare Berhad's extensive network, commitment to innovation, and dedication to quality healthcare services and community outreach make it a prominent and trusted player in the private healthcare industry.