Total 2 Director/C-Level Legal / Public / Security job vacancies in PASIR GUDANG

About the Role

We are seeking an experienced senior manager to lead our information security team, combining strong hands-on technical expertise as well as people management experience in the information security domain. They will lead a team to manage. They will lead a team to manage Security Operations (SecOps), encompassing threat detection and response, incident management, vulnerability management, security monitoring, and continuous improvement of defensive capabilities.

WHAT YOU’LL BE DOING:

Infrastructure Security

• Manage end-to-end infrastructure security activities, such as vulnerability management, servers’ security monitoring & hardening, infrastructure as a code, etc.

• Design and/or review infrastructure security architecture proposal for various security-driven initiatives for on-premises and cloud environment.

Cloud Security

• Manage compliancy level of AIA SG cloud security assets based on ongoing regular scanning according to the defined threshold.

• Evaluate the security aspect of new cloud-based solutions proposed by application development team, infrastructure team, or business users.

• Manage various cloud security BAU activities, such as assets provisioning, deprovisioning, hardening, etc.

Identity and Access Management

• Supervise the AIA-SG IAM Manager and their team performing IAM Governance functions for the Business Unit. 

Cyber Security & Security Incident Handling

• Work with Security Operation Centre (SOC) Team to ensure secure protection of AIA SG environment.

• Deploy new cyber security initiatives and roll out the platform together with SOC Team.

• Point of contact for security incident handling and investigation, starting from incident is identified, handled, and resolved.

Security Advisory

• Provide feasible security recommendations or guidance based on queries / changes initiated by application development team, infrastructure team, or business users.

• Facilitate challenging security conversations and provide acceptable solutions where IT standards are contradicting with business demands to achieve acceptable business solutions without sacrificing security and compliance aspects.

People Development

• Supervise 8 team members.

• Drive a continues Learning and Development program for the team members through inhouse and external training programs.

• Lead promotion of activities to increase information security within your teams to embed and continuously improve adherence to good practice.

WHAT WE ARE LOOKING FOR:

• University degree in one of the following or related disciplines (Computer Science, Computer Engineering, Information Security, Information Systems).

• Minimum 15 years of experiences of information security domain, especially in Application Security, Infrastructure Security and Cloud Security.

• Preferable to have security infrastructure operation background with hands-on experiences of designing and/or reviewing application security or infrastructure security. 

• Hands-on information security experience in the Multiple Cloud Environment (SaaS, PaaS and IaaS) and Cyber Incident management.

• Certifications related to security architecture or Cloud Security is preferable, such as CCSP, Azure DevOps certification, Azure Solutions Architect certification, etc.

• Preferably a holder of one or more of the following information security and audit qualifications: CISSP, CISA, CRISC, CCSP.

• Good knowledge of latest security technologies and cyber landscape in a highly regulated industry.

• Good interpersonal and communication skill.

• Strong leadership with a high integrity, proactive mindset, and strong ownership.

• Working experiences in insurance / banking / IT industry is preferred.

• Infrastructure Security: Windows, Linux, AS400.

• Security Advisory and Assessment, and incident management.

The incumbent will be managing team members in SG/Cyber Technology Centre (Malaysia)/Batam Technology Centre (Indonesia) and responsible for defining and overseeing the organization’s application security architecture, ensuring alignment with target architectures and modern development practices.

WHAT YOU’LL BE DOING:

1. Strategic Oversight of Security Architecture

• Define, design, and implement the target application security architecture in line with organizational goals and industry/regulatory standards.
• Establish a comprehensive application security strategy, ensuring seamless integration into enterprise architecture and technology roadmaps.
• Conduct architectural reviews to identify risks and recommend mitigation strategies, focusing on secure and scalable solutions.

2. CI/CD Pipeline Security

• Lead the integration of security controls into CI/CD pipelines, ensuring automated detection and remediation of vulnerabilities.

3. Secure Software Development Lifecycle (SDLC)

• Develop and enforce secure development guidelines, ensuring security is incorporated at every stage of the SDLC.
• Provide leadership in threat modelling, secure coding practices, and software code quality management across development teams.
• Work with application teams to prioritize security requirements, balancing business objectives with technical risks.

4. Vulnerability Management and Mitigation

• Oversee the overall strategy for SAST, DAST, to identifying and remediating vulnerabilities.
• Ensure timely resolution of identified issues, coordinating efforts across development, QA, and DevOps teams.
• Maintain and communicate detailed metrics and dashboards on the security posture of applications and pipelines.

5. Cross-Functional Collaboration

• Partner with application teams to align security architecture with business needs and project timelines.
• Act as the primary liaison between technical teams and executive leadership, effectively conveying security risks and architectural priorities.

WE ARE LOOKING FOR SOMEONE WITH | YOU WILL HAVE:

• Bachelor’s degree of computer science, Information Security, or a related field. A Master’s degree would be an added advantage.
• Information Systems Security professional certifications, such as CISSP, CSSLP, CEH, OSCP or CREST.
• At least 15 years of experience in cybersecurity, with a focus on application security, security architecture, and secure development practices.
• Proven expertise in designing and implementing security controls within CI/CD pipelines in Agile and DevOps environments.
• Demonstrated success in defining and overseeing secure application architectures for cloud-native and hybrid environments.
• Deep understanding of secure software development lifecycle (SDLC) methodologies and best practices.
• A team-player with systematic problem-solving approach, and have sense of ownership and drive.
• Must have strong people skill to lead a team effectively and demonstrable experience of working at the most senior levels of large and complex organizations.
• Excellent interpersonal skills and stakeholders management.
• Always have customer in mind when dealing with any situations/projects/deliverables.
• Interprets customer needs, assesses requirements and identifies solutions to non-standard requests.
• Able to negotiate with, influence and engage others in complex and conflicting situations across multiple parties to drive a positive outcome.
• Good communication skills and the communication network of the incumbent is expected to be internally within the enterprise (80%) and external with Vendors and Service Providers (20%).