search Browse Jobs
Chief Information Security OfficerBJAK · Malaysia
BJAK logo

BJAK

company page ↗

Chief Information Security Officer

🗓️ Posted 2026-09-03 Malaysia Fulltime Hybrid ICT
💰 Salary Not shared 📊 Market RM20,000–RM40,000/mo

About the Company

We are focused on reinventing how people spend, save, invest, exchange, travel, and more. Our objective is to build tools that will help people get more from their money and and become an expert at ease. We believe AI will help make finance smart, assessible and safe. We have teams working around the world, with over 20 nationalities and growing from our offices and remotely. In 2019, we built the first mobile-first, insurance platform, enabling insurance to be accessible online by millions in the region. Today, it's the leading insurance platform in Southeast Asia.

About the Role

The CISO will own information security and technology risk for doit Holdings, our regulated investment platform in Malaysia, and will be the person the board names as responsible for technology risk under the Securities Commission's Guidelines on Technology Risk Management. Nothing exists yet. The framework, the controls, the monitoring and the evidence all have to be built, and they have to hold up to an independent assessment before the platform can be registered.

Responsibilities

  • ● Hold the board-appointed responsibility for day-to-day technology risk oversight and for delivering the board's cyber security strategy.
  • ● Build the technology risk and cyber security frameworks, the risk appetite statement and the policy set beneath them, and keep them approved and current.
  • ● Run security operations across monitoring, vulnerability and patch management, access control, data protection, cryptography and secure development.
  • ● Own incident response from detection through recovery, including the report to the SC on the day an incident occurs.
  • ● Take the platform through the independent technology validation that gates registration, and close what it finds.
  • ● Take ISO/IEC 27001 from scoping through to certification.
  • ● Deliver the annual cyber security awareness programme across the board, senior management and staff.

Requirements

  • ● Deep information security background, with at least 8 years in the field including 5 in financial services or another regulated sector.
  • ● At least one of CISSP, CISM or CISA.
  • ● Deep command of the SC's Guidelines on Technology Risk Management, operationalised rather than restated.
  • ● Real depth in cyber security, operational resilience, and cloud and third-party risk.
  • ● ISO/IEC 27001 implementation experience through to certification.
  • ● A degree in computer science, information technology, information security or a cognate discipline, and able to meet the SC's fit and proper criteria.
  • ● ISO/IEC 27001 Lead Implementer or Lead Auditor, CRISC or CCSP, or experience of an SC or BNM technology examination, is useful.
  • ● Hands-on operating style. Able to review the controls, run the simulation and close the gaps personally.
  • ● Strong English communication is required.