Head of Information Security

About the Company

Responsibilities

• ● Develop, maintain, and enforce enterprise information security policies, standards, procedures, and guidelines.
• ● Ensure compliance with SEC, BOT, AMLO, PDPA, and applicable cybersecurity regulations.
• ● Act as principal liaison for all security-related regulatory examinations and inspections.
• ● Prepare and maintain security documentation required for licensing and regulatory submissions.
• ● Coordinate internal and external security audits.
• ● Track remediation activities and evidence collection for audit findings.
• ● Present security risk reports to executive management, Risk Management Committee and the Board.
• ● Operate and oversee daily cybersecurity monitoring activities.
• ● Review security alerts, event logs, vulnerability reports, and threat intelligence feeds.
• ● Manage endpoint security, identity and access management, privileged access controls, and network security configurations.
• ● Maintain secure baseline configurations across all corporate and production systems.
• ● Periodically validate effectiveness of security controls.
• ● Design, maintain, and monitor security controls protecting customer digital assets.
• ● Oversee wallet security architecture including key management processes.
• ● Ensure secure operation of offline private key storage and associated custody infrastructure.
• ● Review transactional security controls and approval workflows.
• ● Implement and validate cryptographic control requirements.
• ● Maintain processes supporting segregation of duties and multi-party authorization controls.
• ● Establish and maintain enterprise technology and cybersecurity risk registers.
• ● Conduct periodic security risk assessments.
• ● Evaluate risks arising from vendors, outsourcing arrangements, cloud services, software providers, and technology partners.
• ● Track risk treatment plans and remediation activities.
• ● Develop security metrics and key risk indicators.
• ● Own the cybersecurity incident response program
• ● Lead investigations involving security breaches, suspicious activity, fraud attempts, insider threats, or operational security incidents.
• ● Coordinate external forensic specialists where necessary.
• ● Conduct post-incident reviews and remediation planning.
• ● Manage security communications to executives, auditors, regulators, and affected stakeholders.
• ● Vulnerability and Security Testing
• ● Coordinate regular vulnerability assessments and penetration tests.
• ● Personally validate remediation of identified findings.
• ● Conduct ongoing security reviews of infrastructure, applications, and operational processes.
• ● Track security weaknesses and ensure timely resolution
• ● Perform security due diligence for technology vendors and outsourcing partners.
• ● Assess contractual security obligations.
• ● Monitor vendor compliance with security requirements.
• ● Review SOC reports, independent assessments, and vendor certifications.
• ● Business Continuity and Operational Resilience.
• ● Maintain cyber resilience and disaster recovery capabilities.
• ● Develop and test incident response, disaster recovery, and business continuity plans.

Requirements

• ● Minimum 8-12 years of information security experience
• ● Minimum 3-5 years in a senior security leadership position
• ● Prior experience within financial services, banking, securities, fintech, payment services, digital assets, or regulated institutions strongly preferer
• ● Demonstrated experience operating within highly regulated environment