Head of Information Security - Singapore

Constructor Knowledge AG; Singapore; On-site; SGD 180,000 - 280,000; Full time

Benefits offered by this job

Choice of equipment

Flexible schedule

Remote work where no office exists

Hybrid work in offices (2 days in)

Job summary

Constructor is seeking a Head of Cybersecurity in Singapore to lead the security function across appsec, compliance, infrastructure, and business applications. This hands-on leadership role reports to the CTO and will grow a small security team, including security strategy and technical deep-dives.

The role includes securing CI/CD, managing ISO 27001 and SOC 2, and collaborating with DevOps on Kubernetes and cloud security. Based in Singapore with hybrid work (2 days in-office).

Qualifications

• 8+ years in information security, incl. 3+ years in a leadership role.
• Track record running application security programs with CI/CD tooling and AI-assisted reviews.
• Hands-on experience with ISO 27001 and/or SOC 2, with audit leadership.
• Experience securing business applications (M365, CRM, ERP) and vendor risk management.
• Ability to explain risk to engineers and executives.
• Comfortable leading a small team and prioritizing across demands.
• Working knowledge of Kubernetes and cloud security; sovereign cloud a plus.

Responsibilities

• Build and run AppSec program with AI-assisted reviews of code and PRs.
• Integrate security checks into CI/CD pipelines to catch vulnerabilities before production.
• Run developer security training and champion secure coding practices across the org.
• Evaluate and roll out AI coding tools to improve code security.
• Own ISO 27001 and SOC 2 certification and ongoing security audits.
• Build a roadmap for additional certifications as the business requires.
• Maintain scalable policies, controls, and evidence.
• Secure Kubernetes infrastructure and cloud environments, incl. sovereign cloud deployments.
• Define security standards for IaC, network, and access control.
• Partner with Engineering on secure-by-default configurations.
• Work with IT and Business apps to secure M365, CRM, ERP; manage identity/data protection.
• Own identity, access, and data protection across business apps.
• Manage third-party/vendor risk for SaaS.

Skills

Information security leadership

Security governance

Cloud security

Tools

CI/CD tooling

Kubernetes

IAM

Job description

Head of Information Security - Singapore

Our mission

Constructor’s mission is to enable all educational organisations to provide high-quality digital education to 10x people with 10x efficiency.

With strong expertise in machine intelligence and data science, Constructor’s all-in-one platform for education and research addresses today’s pressing educational challenges: access inequality, tech clutter, and low engagement of students.

About the Role

We'relooking fora Head of Cybersecurity toexpandand lead our security function across four areas: application security,securitycompliance, infrastructure & cloud security, and business application security.You'llreport to the CTO and take over a small existing security team, with a mandate to grow it as the company scales.

This is a hands-on leadership role.You'llset direction and represent security to leadership, butyou'realso expected to dig into technical detail with engineering, IT, and compliance teams.

Based in Singapore, hybrid (2 days/week in office),occasionalinternational travel may berequired.

Duties & Responsibilities

Application security

• Build and run our AppSec program, including agentic/AI-assisted security reviews of code and pull requests
• Integrate security checks into CI/CD pipelines so vulnerabilities are caught before production
• Run developer security training and champion secure coding practices org-wide
• Evaluate and roll out AI coding tools in ways that improve, not undermine, code security

Security compliance

• Own ISO 27001 and SOC 2 certification and ongoingsecurityaudits
• Collect requirements from stakeholders and build a roadmap for additional certifications as the business requires them
• Maintain policies, controls, and evidence in a way that scales without slowing teams down
• Work closely with our DevOps organization to secure our Kubernetes infrastructure and cloud environments, including sovereign cloud deployments
• Define security standards for infrastructure-as-code, network architecture, and access control
• Partner with Engineering teams on secure-by-default configurations

Business Application Security

• Work closely with ITand Business applicationteamsto secure Microsoft 365 and other line-of-business systems, including CRM and ERP
• Own identity, access, and data protection controls across business applications
• Manage third-party/vendor risk for business-critical SaaS

Qualifications & Experience:

• 8+ years in information security, including 3+ years in a leadership role, preferably in all-remote or hybrid international organizations
• Track record running application security programs, ideally with CI/CD-integrated tooling and modern (AI-assisted) code review
• Hands-on experience with ISO 27001 and/or SOC 2, proven experience leading and successfully completing the audit, not just reading the standard
• Experience securing business applications (M365, CRM, ERP) and vendor risk management
• Ability to explain risk and trade-offs clearly to both engineers and executives
• Comfortable operating with a small team and prioritizing across competing demands
• Working knowledge of Kubernetes and cloud security; sovereign cloud experience is a plus

What We Offer

• Choice of work equipment (e.g., laptop, monitor, etc.)
• Flexible schedule (we usually work between 09:00/10:00 and 18:00/19:00 CET or EET)
• Remote work in locations without our offices
• Hybrid work in locations with offices (2 days in-office, 3 days remote)

Constructor fosters equal opportunity for people of all backgrounds and identities. We are led by a gender-balanced board committed to building a diverse and inclusive organisation where everyone can become their best self. We do not discriminate based on age, disability, gender identity, sexual orientation, ethnicity, race, religion or belief, parental and family status, or other protected characteristics. We welcome applications from women, men and non-binary candidates of all ethnicities and socio-economic backgrounds. We encourage people belonging to underrepresented groups to apply.