Senior Information Security Specialist

Monee; Kuala Lumpur; On-site; MYR 120,000 - 180,000; Full time

Job summary

Monee Malaysia, part of Sea Limited, seeks a Senior Information Security Specialist to safeguard digital assets across ShopeePay and Monee Malaysia. You will lead risk assessments, guide security policies, and oversee incident response to maintain a strong security posture and regulatory compliance.

The role requires 5–7 years in information security with at least 3 years in a senior capacity, plus certifications such as CISSP, CISM, CEH, CRISC or similar.

Qualifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• Minimum 5–7 years of direct experience in an Information Security/Cybersecurity role, with at least 3 years in a senior capacity.
• Certifications in IT Risk and Cybersecurity (CC, CEH, CISSP, CISM, CRISC) or similar.

Responsibilities

• Lead the development and maintenance of information security frameworks, policies, and guidelines.
• Oversee security risk assessments, audits, and gap analyses to identify threats and remediation.
• Manage information security incident response, containment, and root-cause analysis.
• Coordinate regulatory/compliance reporting for technology matters to management and boards.
• Collaborate with DevSecOps, IT, and engineering teams to embed security in SDLC and cloud architectures.
• Develop security awareness programs and mentor junior staff.

Skills

Security risk assessment

Incident response leadership

Regulatory compliance

Security governance

Communication skills

Education

Bachelor's degree in Computer Science/Information Technology/Cybersecurity or related field

CISSP

CISM

CEH

CRISC

CC

Tools

SIEM

DLP

IDS/IPS

EDR

Vulnerability scanning tools

Python scripting

PowerShell

Job description

Monee is a leading digital payments and financial services provider in Southeast Asia, with a growing presence in Latin America. Its mission is to better the lives of individuals and businesses in the region with financial services through technology.

Monee delivers a comprehensive range of digital financial products and services, including mobile wallets, payment processing, credit, banking, and insurtech. By leveraging technology and strategic partnerships, Monee aims to drive greater digital financial inclusion, convenience, and accessibility for individuals and small businesses across Southeast Asia and Latin America.

Monee is part of Sea Limited, a global technology company.

As a Senior Information Security Specialist at ShopeePay & Monee Malaysia, you will play a key role in safeguarding our digital assets, information systems and data. You will leverage your extensive information security/cybersecurity experience to develop, implement and manage robust security strategies, policies, and controls. This role involves leading security risk assessments, providing expert technical guidance and overseeing the incident response process to maintain a strong security posture and ensure compliance with regulatory requirements.

Security Strategy & Governance

• Lead the development, implementation, and maintenance of a comprehensive information security framework, policies, procedures, and guidelines.
• Ensure that the organization's security posture aligns with compliance requirements (e.g., NIST CSF, ISO 27001, BNM RMiT/MCIPD, Cyber Security Act, SC TRM, PDPA, SOC2/etc).
• Review and endorse IT and Cybersecurity risk assessments, risk acceptances as well as technology Key Risk Indicators (KRI)
• Provide information security guidance to business and cross‑functional teams.
• Coordinate and complete regulatory/compliance posture reporting for technology matters to the related management and Board committees.
• Conduct holistic security risk assessments, audits, and gap analyses to identify gaps, vulnerabilities and potential threats to our systems and networks.
• Oversee and conduct penetration testing, vulnerability scanning, and security architecture reviews.
• Perform independent review / analysis of critical technology / cyber risks, and identify areas for improvement, e.g., network architectural design, Vulnerability Assessment and Penetration Testing (VAPT) findings.
• Recommend and manage the implementation of effective remediation strategies to mitigate identified risks, tracking them through to resolution.

IT Incident Response, Disaster Recovery & Operations

• Lead the information security incident response process, including investigation, containment, mitigation, and root cause analysis of security breaches and events.
• Serve as a technical Subject Matter Expert (SME) during legal, regulatory, or corporate investigations, ensuring proper collection, preservation, and chain of custody for digital evidence.
• Plan, lead, and report on regular, full‑scale DR testing and simulation exercises, identifying gaps in the recovery procedures and working with infrastructure teams to remediate the gaps.
• Provide security advice on integrating security requirements into the DR process, ensuring that data and systems recovered at the designated site.
• Conduct Business Impact Analyses (BIA) and risk assessments from a security perspective to determine the criticality of systems and define appropriate Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
• Prepare and submit detailed incident reports by translating complex technical jargon details into clear business risks and recommendation actions.
• Collaborate with IT, Infrastructure, Engineering, Security and Development teams (DevSecOps) to integrate security best practices into the System Development Lifecycle (SDLC) and secure system architecture.
• Provide expert technical advice and security requirements for new products, projects, systems, technologies and third party engagement.
• Develop and deliver periodic security awareness training/learning programmes and communications to employees and stakeholders.
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field.
• Minimum of 5-7 years of direct experience in an Information Security or Cybersecurity role, with at least 3 years in a senior capacity.
• Must possess relevant certifications in IT Risk and Cybersecurity in at least one of the following but not limited to:-
  • Certified in CyberSecurity (CC)
  • Certified Ethical Hacker (CEH)
  • Certified Information Systems Security Professional (CISSP)
  • Certified Information Security Manager (CISM)
  • Certified in Risk and Information Systems Control (CRISC)
  • Other relevant cybersecurity certifications
• Proven knowledge and experience in security architecture design, network security protocols, application security assessment, disaster recovery, cloud security and secure system design.
• Proven experience in designing and implementing security controls within on‑premise and cloud environments.
• Hands‑on proficiency with security tools and technologies (e.g., SIEM, DLP, IDS/IPS, EDR, APT, DDOS/etc).
• Strong understanding of security governance, risk management, and regulation frameworks (e.g., NIST CSF, ISO 27001, BNM RMiT/MCIPD, Cyber Security Act, SC TRM, PDPA, SOC2/etc).
• Exceptional analytical and problem‑solving skills with a keen attention to detail.
• Strong verbal and written communication skills, with the ability to explain complex security issues to both technical and non‑technical audiences.
• Demonstrated ability to lead projects, manage competing priorities, and drive continuous process improvement.
• Experience with digital forensics and malware analysis.
• Experience with scripting languages (e.g., Python, Bash, PowerShell) for security automation and task efficiency is a plus.
• Able to cover Cybersecurity, IT and Business Continuity risks for both ShopeePay and Monee Malaysia.