Head of Information Security

Role Summary

The Head of Information Security (CISO) is responsible for developing, implementing, and maintaining the organization's information security strategy, governance framework, and cybersecurity programs. This role ensures the confidentiality, integrity, and availability of company information assets while supporting business growth, regulatory compliance, and risk management objectives.

Key Responsibilities

Security Strategy & Leadership

Develop and execute the organization's information security strategy and roadmap.

Establish cybersecurity policies, standards, and procedures aligned with business objectives.

Advise executive leadership and senior management on cybersecurity risks and mitigation strategies.

Foster a security-aware culture across the organization.

Governance, Risk & Compliance

Lead the enterprise information security governance framework.

Conduct regular risk assessments and maintain the organization's cyber risk register.

Ensure compliance with applicable laws, regulations, and industry standards (e.g., ISO 27001, SOC 2, NIST, GDPR, PDPA).

Manage internal and external security audits.

Cybersecurity Operations

Oversee security monitoring, threat detection, and incident response capabilities.

Lead investigations into security incidents and coordinate remediation activities.

Ensure effective vulnerability management, penetration testing, and security assessments.

Drive continuous improvement of security controls and technologies.

Security Architecture & Technology

Provide strategic direction on security architecture, cloud security, identity and access management, data protection, and network security.

Evaluate and implement security solutions to address emerging threats.

Ensure secure design principles are embedded into business processes and technology initiatives.

Third-Party & Vendor Security

Establish processes to assess and monitor third-party cybersecurity risks.

Review vendor security controls and contractual security requirements.

Manage security due diligence for new partnerships and technology implementations.

Business Continuity & Resilience

Oversee cybersecurity aspects of business continuity and disaster recovery planning.

Conduct cyber incident simulations and tabletop exercises.

Ensure organizational readiness for cyber threats and disruptions.

Team Leadership

Build, mentor, and lead the Information Security team.

Manage security budgets, resources, and vendor relationships.

Define performance objectives and professional development plans for team members.

Qualifications & Experience

Required

Bachelor's degree in Information Security, Computer Science, Information Technology, or a related field.

12+ years of progressive experience in cybersecurity, information security, IT risk, or related disciplines.

5+ years in a senior leadership or management role.

Strong knowledge of cybersecurity frameworks, standards, and regulations.

Experience leading security programs in a complex enterprise environment.

Proven experience managing cybersecurity incidents and regulatory compliance requirements.

Key Competencies

Strategic thinking and business acumen

Leadership and stakeholder management

Risk management and decision-making

Incident response and crisis management

Strong communication and influencing skills

Regulatory and compliance expertise

Vendor and budget management