ED, Cybersecurity Governance, Risk & Compliance Head, Information Security Services, Group Technology

DBS; Singapore; Presencial; SGD 300.000 - 540.000; Tempo integral

Resumo da vaga

DBS invites an experienced ED, Cybersecurity Governance, Risk & Compliance Head to lead the first line of defence for cybersecurity within Group Technology in Singapore. You will drive regulatory compliance, awareness and data protection, and report on the cybersecurity posture to DBS risk committees.

The role requires 15+ years in information security in financial/tech environments with strong expertise in ISO27000, NIST 800-53, and Cybersecurity Act.

Qualificações

• 15+ years of information security experience in financial/tech environments.
• Experience in developing and reporting security metrics (vulnerabilities, findings, alerts, incidents).
• Familiarity with ISO27000, NIST 800-53 and regulations such as Cybersecurity Act and PDPA.
• Strong working knowledge of enterprise security risk management methods and techniques.
• Hands-on experience with security tech (IDS/IPS, anti-virus, content filtering, network monitoring, log analysis, forensics, VPN).
• Experience with data analytics, ML techniques and SDLC.

Responsabilidades

• Drive regulatory compliance and governance for cybersecurity under the 1st Line of Defence.
• Oversee cybersecurity awareness and training programs for stakeholders across the bank.
• Lead data protection management including data loss prevention and analytics.
• Coordinate with enterprise data security and risk teams and external auditors/certification bodies.

Conhecimentos

Cybersecurity governance

Risk management

Compliance

Data analytics

Security metrics

Training development

Stakeholder management

Ferramentas

ISO27000

NIST 800-53

Cybersecurity Act

Descrição da vaga

ED, Cybersecurity Governance, Risk & Compliance Head, Information Security Services, Group Technology### ED, Cybersecurity Governance, Risk & Compliance Head, Information Security Services, Group TechnologyApply: Infrastructure, Cloud & Information Security: Singapore - East: Full time: Posted Today: WD90046**Business Function** Group Technology enables and empowers the bank with an efficient, nimble, and resilient infrastructure through a strategic focus on productivity, quality & control, technology, people capability and innovation. In Group Technology, we manage most the Bank's operational processes and inspire to delight our business partners through our multiple banking delivery channels. **About the role** DBS operates a 3 Lines of Defence model for cybersecurity risk management. This role serves as Line 1, with responsibilities for driving regulatory compliance and governance, awareness and training and data protection for cybersecurity within the bank. **Cybersecurity Governance, Risk and Compliance** As the 1st Line of Defence, the incumbent is responsible for driving the Bank’s compliance with the relevant cybersecurity legislation (e.g. Singapore’s Cybersecurity Act) and regulations (e.g. MAS). The responsibilities include: * Development of cybersecurity standards and guidelines,* Assessment and validation of cyber risks and controls applic , and* Reporting and providing assurance for the cybersecurity program to DBS risk committees. The candidate will work with key stakeholders to implement controls and practices to manage the cyber risks and ensure the identified risks and gaps are adequately addressed and remediated. The candidate is also responsible for providing oversight and governance over cybersecurity related activities and update management on the metrics and compliance posture of the cybersecurity environment. **Cybersecurity Awareness and Training** The candidate is responsible for the development and delivery of the cybersecurity awareness and training program for the stakeholders within the Bank, including the design and development of targeted content to meet the training needs for the different roles in the Bank. The candidate is to continuously assess the efficacy of the training program, and improve and update the training content. **Data Protection Management** The incumbent will be responsible for the driving the data protection program including data loss management within the Bank. This includes the design of the data protection control environment, implementation and operations of the data protection technologies, and driving the data protection operations. The role also requires the candidate to drive the inhouse data analytics program to prioritize data loss events and identify potential misuse of the Bank’s applications and customer data. This role will be required to work closely with key stakeholders including the Enterprise Data Security and Data & AI Risk team. **Cybersecurity Governance, Risk and Compliance Responsibilities** * Legislation, regulations and policies* Review and assess the Bank’s cybersecurity policy architecture for compliance with new and emerging cyber security legislation, regulations and policies.* Review and update information security standards to comply with the regulatory requirements as required* Work with regional information security services teams in the core markets to monitor new cybersecurity legislation and/ or regulation, and assess the impact to and the compliance of the Bank’s security policy architecture* Where necessary, work with Line of Business Technology units to drive change management to comply with the regulatory guidelines* Security risk and compliance* Work with key Line of Business Technology to manage material changes to critical systems, conduct risk control self assessment to assess key cybersecurity controls and risk areas and ensure continuous compliance with the cybersecurity legislation and regulations* Engage Line of Business Technology units to conduct annual cybersecurity risk assessment for key bank systems as required under the prevailing regulations* Engage external auditors and certification bodies to assess and audit key bank systems and control environment under the Cyber Trust Mark, ISO27000, SOC2 and Cybersecurity Act* Focal point for international centres on information security matters* Security metrics* Develop and maintain a set of security metrics and visualization for the reporting of cybersecurity landscape to senior management and the Board* Where possible, automate the extraction, transformation and loading of raw security events to generate the security metrics and graphs for the reporting* Establish a framework to organize, manage and archive the security data used for the generation of security metrics and visualization* Generate quarterly reports and insights to apprise senior management of the security trends and areas of concern **Cybersecurity Awareness and Training** * Conduct regular phishing exercises and disseminate timely cybersecurity content to inculcate the cybersecurity hygiene and practices* Develop targeted training content and collaborate with various control functions to deliver the content to meet the training needs for specific stakeholders* Drive annual cybersecurity awareness campaign to promote cybersecurity culture and behavior **Data Protection Management** * Data Loss Prevention* Design and implement data protection controls to mitigate the risk of data loss across various channels including web, email, network, endpoint etc.* Work with Line of Business Technology to design and implement technology enablers to support the secure handling of Bank’s and customers’ data* Review and investigate data loss events and refer substantiated events to HR for disciplinary actions* Continuously review and enhance the data protection controls to improve the efficacy of data loss prevention* Provide management reporting on data loss matters to the Bank’s risk committees.* Unusual Employee Behavior Monitoring* Drive the implementation of data analytics and machine learning techniques to + Prioritize and highlight data loss events for review and investigation + Identify suspicious activities and misuse of applications and customer data* Oversee the inhouse development of the machine learning models and investigation platform* Drive the development and implementation of data visualization techniques to improve the efficiency of the review and investigation process* Drive the development and enhancement of the investigation platform to meet the users’ need **Requirements** * Information security professional with 15 or more years of experience, with a background in a financial or technology environment.* Experience in implementing a program the collation, management and reporting of security metrics such as open security vulnerabilities, penetration testing findings, security alerts and incidents, etc.* Experienced in information security framework including ISO27000, NIST800-53 and regulations such as Cybersecurity Act, Technology Risk Management Guidelines and Personal Data Protection Act.* Good working knowledge of enterprise security risk management methods and techniques to successfully deliver the security risk management and assessment outcome.* Strong background on security technology solutions including IDS, IPS, anti-virus, content filtering, secure email solutions, network sniffing, log analysis, forensics and VPN* Hands-on technical experience in the management of security data for the generation of security metrics and visualization* Good working knowledge of data analytics, machine learning techniques and software development lifecycle* Good verbal and written communication for the generation of security awareness content* Proactive, analytical and independent worker with strong organization skills and performance-oriented, demonstrate effectiveness to track and follow up on the assigned projects* Regional experience is a plus and the ability to travel on need-to basis**Location:**DBS Asia Hub**Job:**Technology**Schedule:**Regular**Employee Status:**Full time