IT Security Officer

What You Will Do

• Compliance, governance & audit readiness (primary focus, current bottleneck): Own audit documentation across all entities — policies, procedures, control evidence, risk registers, and remediation records, kept audit-ready at all times; plan and perform security tests (vulnerability scans, penetration tests, control testing) and capture the evidence auditors require; maintain compliance with OJK, Bank Indonesia, UU PDP, PCI-DSS, ISO 27001, and SOC 2; serve as primary contact for internal/external auditors and regulators, driving findings to closure; develop and enforce security policies and standards across all functions and entities.
• Security operations: Monitor systems and transactions across functions and entities; run security tooling; lead incident response and regulatory breach notification.
• Vulnerability management: Scan, patch, and coordinate pen tests; track fixes to closure.
• Access & identity: Enforce least-privilege, MFA, PAM, and segregation of duties around funds and production data.
• Application & infrastructure security: Harden systems and cloud; manage encryption and secure baselines; embed security into each team's SDLC.
• Risk management: Run risk assessments; vet vendors and third-party integrations; advise on secure product design.
• Awareness & resilience: Train staff across functions and entities; run phishing simulations; support disaster recovery and business continuity.