Security Manager, Information Security

Tranglo is seeking a highly strategic and experienced Senior Manager, Information Security to lead our enterprise security governance, risk management, and compliance initiatives. In this executive-level role, you will serve as the primary advisor to the C-suite and Board of Directors on all matters related to cyber risk and regulatory alignment.

This role is strictly focused on strategic architecture, regulatory compliance (specifically BNM RMiT), and overseeing the successful transition and recertification of ISO 27001:2022. You will design the overarching Information Security Management System (ISMS) framework and provide strategic oversight to the Information Security Manager, who remains responsible for day-to-day technical enforcement and internal operations.

Key Responsibilities

1. Strategic Governance & ISMS Architecture

• Lead, architect, and manage Tranglo’s enterprise-wide Information Security Management System (ISMS).

• Drive the implementation and continuous certification of the ISO/IEC 27001:2022 standard, serving as the primary point of contact for external auditors and certification bodies.

• Define and publish enterprise security policies, standards, and strategic objectives that align with Tranglo’s fintech business goals and risk appetite.

2. Regulatory Compliance & Enterprise Risk Management

• Ensure absolute alignment and compliance with Bank Negara Malaysia (BNM) Risk Management in Technology (RMiT) requirements, the Personal Data Protection Act (PDPA), and other relevant global financial regulations.

• Own and maintain the enterprise Information Security Risk Register, ensuring risks are accurately identified, assessed, and treated (Accept, Mitigate, Transfer, Avoid).

• Present periodic cyber risk postures, threat landscapes, and compliance dashboards directly to the ISMS Committee, C-suite, and Board of Directors.

3. Third-Party & Supply Chain Security Leadership

• Design and oversee the enterprise Third-Party Vendor Security Management framework.

• Serve as the final escalation point for critical vendor risk assessments, working with Procurement, HR-Admin, and respective DICs to govern "Gate 0" triage and risk acceptance workflows.

• Advise the ISMS Committee on supply chain vulnerabilities and cloud service risks.

4. Leadership & Departmental Oversight

• Provide strategic direction, mentorship, and high-level oversight to the Information Security Manager and operational security team.

• Delineate clear boundaries between strategic governance (owned by this role) and tactical/technical security operations (owned by the InfoSec Manager).

• Foster a culture of security awareness across all business units, championing security as a business enabler rather than an operational roadblock.

Qualifications & Requirements

Education, Experience and Required Certifications

• Bachelor’s or Master’s degree in Information Security, Cybersecurity, Computer Science, or a related field.

• 8–10+ years of progressive experience in Information Security, with at least 3–5 years in a strategic leadership or governance role.

• Mandatory background in the Financial Services, Fintech, or Banking sector, with deep, practical knowledge of managing security in highly regulated environments.

• Proven, demonstrable experience leading an organization through an ISO 27001:2022 certification or transition audit.

• Must hold at least one active, globally recognized executive security certification: CISSP, CISM, or CRISC.

• ISO/IEC 27001:2022 Lead Auditor or Lead Implementer certification is highly preferred.

Technical & Regulatory Knowledge

• Expert-level understanding of BNM RMiT guidelines and expectations.

• Strong command of modern enterprise architecture, cloud security (AWS/Azure/GCP), and secure application development frameworks.

• Ability to translate complex technical cyber threats into business risk language for executive stakeholders.

Soft Skills

• Advanced Stakeholder Management: Proven ability to influence, negotiate with, and guide stakeholders at all levels (from operational senior management to the Board) toward secure business practices.

• Strategic Critical Thinking: High capacity for complex problem-solving, with the ability to objectively analyze organizational workflows, anticipate downstream impacts of security policies, and formulate holistic solutions rather than reactive fixes.

• Detail-Oriented Execution: Meticulous attention to detail when reviewing regulatory frameworks, vendor contracts, risk registers, and audit evidence to ensure zero compliance gaps.

• Executive Communication: Exceptional written and verbal communication skills, including the ability to firmly enforce security boundaries while maintaining professional, productive relationships.