Senior IT Security Specialist, Security Assurance

RHB Group; Selangor; On-site; MYR 300,000 - 420,000; Full time

Job summary

RHB Group is seeking an experienced IT Security Lead to define and maintain the security advisory and risk assessment framework aligned with our cybersecurity strategy in Malaysia. You will mentor a team, drive assurance across Windows, Linux, cloud, and mobile security, and coordinate with governance to report risks to senior management.

Responsibilities include leading ISO 27001 certification, ISMS management, conducting risk assessments, validating controls, and enabling secure deployment

Job description

• Assist section head to define and maintain the security advisory and risk assessment framework aligned with corporate cybersecurity strategy.

Leadership and Strategic Oversight

• Mentor a team of IT Security Assurance
• Assist section head to define and maintain the security advisory and risk assessment framework aligned with corporate cybersecurity strategy.

System Hardening and Configuration Compliance

• Review and validate operating system hardening configurations for Windows and Linux servers and others as listed in List of Technologies.
• Assess database security configurations and hardening controls for enterprise databases.
• Validate application security configurations and adherence to secure configuration standards.
• Review network device hardening, including firewalls, routers, switches, load balancers, and web application firewalls.
• Assess cloud security configurations and ensure compliance with approved cloud security baselines like Dockers,S3 Bucket , AzureDocDB and others.
• Verify compliance with hardening standards, benchmarks, and security best practices.
• Conduct periodic hardening and Adhoc QA scan and identify configuration weaknesses.
• Ensure security patches and configuration updates are implemented according to organizational requirements.
• Report significant risks and mitigation progress to senior management and governance committees.
• To align and execute IT security risk assessment according to Group Risk IT risk assessment methodology

ISO 27001 Certification and ISMS Management

• Lead the ISO 27001 certification and maintenance process, ensuring continuous compliance of the Information Security Management System (ISMS).
• Coordinate internal and external audits, managing relationships with auditors and certification bodies.
• Ensure risk assessments, Statement of Applicability (SoA), and ISMS documentation remain current and aligned with evolving business and regulatory requirements.
• Track and manage audit nonconformities, corrective action plans, and improvement initiatives.

Security Assurance

• Conduct security risk assessments and identify security gaps, vulnerabilities, and control deficiencies.
• Validate implementation of security controls, including authentication, authorization, logging, monitoring, and encryption.
• Support security governance initiatives and provide recommendations to mitigate identified risks.
• Review and track security findings, risk exceptions, and remediation activities.
• Provide security assurance and approval prior to production deployment.
• Collaborate with project teams, infrastructure teams, developers, and security stakeholders to ensure security requirements are addressed.

Mobile Apps Security

• Perform security assessments of Android and iOS mobile applications.
• Coordinate and review third-party risk assessments and recommend mobile configuration.

Operational Excellence

• Monitor performance, completeness and effectiveness of all managed security tools and controls.
• Implement automation and process improvement to reduce operational overhead
• Define KPIs and SLAs for tool uptime, incident response and compliance posture.

Governance, Risk, and Compliance

• Ensure all security controls meet internal and external regulatory requirements.
• Own the documentation of policies, procedures, operation manual and security standards related to managed systems
• Assist internal and external audits for the security technologies under this section.
• Drive remediation plans for audit findings and ensure timely closure.