Information Security Risk Manager

A Financial Institution is looking for an Information Security Risk Manager to lead information security across its Asia Pacific business. This is a senior, regionally-facing position with direct visibility to senior management and risk governance forums.

Key responsibilities

• Own the information security strategy and roadmap for the region, aligning local practice with group policy and relevant regulatory expectations
• Lead and develop a team of information security professionals, setting priorities and managing performance
• Manage external penetration testing and red-team vendor engagements, ensuring findings are tracked through to remediation
• Build and mature vulnerability management capability across the region, embedding automation and metrics into business-as-usual operations
• Act as escalation point for security incidents, coordinating investigation and reporting through to resolution
• Provide security input on new technology and cloud initiatives, reviewing risk before systems go live
• Drive security awareness programmes to build risk culture across the business
• Oversee outsourcing and third-party vendor risk, including due diligence and ongoing monitoring of critical suppliers
• Act as regional contact point for data protection matters, covering compliance and breach response
• Represent information security at risk committees and senior governance forums

What we're looking for

• Financial industry experience is essential
• Strong information security leadership experience within financial services, ideally with regional APAC coverage
• Proven experience managing and developing a team
• Working knowledge of a major technology risk framework (e.g. MAS TRM or equivalent)
• Track record managing audits, penetration testing and security vendors
• Comfortable presenting to senior stakeholders and risk committees
• Exposure to outsourcing/vendor risk and data protection compliance is a strong plus