Chief Information Security Officer (CISO) | Fintech / Digital Payments | Hanoi

We are looking for a hands-on CISO for a fintech / payment intermediary company in Hanoi. This is a CISO role with real authority. You will report directly to the CEO, sit on the Information Security Council, and have the right to recommend pausing a system rollout or operation when serious risks remain unaddressed.About the RoleYou will build and lead the company’s end-to-end information security program, protecting systems, data, customers and business operations against cyber risk. You will also ensure the company can meet, and demonstrate, compliance with State Bank of Vietnam (SBV) requirements, Vietnamese law and applicable security standards.What You Will DoSecurity Strategy & ArchitectureAssess security maturity; define the security strategy, target architecture and a 2–3 year roadmap aligned with business strategy.Prioritize security investments by risk and decide whether to build, buy or outsource each capability.Set security architecture principles across network, infrastructure, cloud, applications, APIs, data, encryption, key management and privileged access.Build and Lead the Security TeamRecruit, train and develop two functions: GRC and SecOps.Ensure separation of duties as required by regulation; build strong in-house capability and use external partners as support, not as a replacement for internal judgment.Risk, Compliance & Data ProtectionOwn the Information Security Policy framework, risk management framework, risk and exception registers, and system security-level classification dossiers.Drive compliance with Vietnam’s 2025 Personal Data Protection Law and related decrees (data classification, encryption, DLP, impact assessments, data subject rights).Serve as the primary contact for the SBV on periodic reporting, incident reporting, inspections and audits.Security Operations, Incident Response & ResilienceDirect 24/7 security monitoring with SOC/MDR partners; continuously improve MTTD and MTTR.Run vulnerability management, IAM/PAM and regular penetration testing.Lead incident response with at least two exercises per year; work with IT and Operations on BCP/DRP, RTO/RPO and recovery of critical systems.Product Security, DevSecOps & AIEmbed security across the SDLC (threat modeling, application and API testing, dependency and source code control).Establish security governance principles for AI and AI workflows.Partners, Budget & Executive ReportingManage the security budget and third-party risk.Report quarterly to the Security Council and Board with quantified risk metrics in business language.Build a security culture: company-wide awareness, phishing simulations and a Security Champion network within engineering.RequirementsMinimum 8 years of information security experience, including at least 3 years managing a security team.Experience in banking, finance, fintech, payment intermediary or high-security digital transaction environments, with exposure to tightly regulated settings.Strong knowledge of Vietnam’s security regulatory framework (Circular 09/2020, Circular 50/2024, the 2025 Personal Data Protection Law, information system classification by level) and hands-on experience with ISO/IEC 27001, PCI DSS and NIST CSF.Experience in both governance/compliance (GRC) and security operations (SOC, incident response, vulnerability management); able to manage outsourced security providers and assess the quality of their output.Ability to explain technical risk in business terms to senior leadership and the Board.Ability to pass background checks required for critical roles (including a criminal record check).Nice to HaveDirect experience implementing SBV Circular 09/2020 (or the earlier Circular 18/2018), working with regulators and taking part in security inspections and audits.CISSP, CISM or CRISC (strongly preferred); ISO 27001 Lead Auditor/Implementer or CISA is a plus.Led an organization through Level 3 security compliance, or through ISO/IEC 27001 or PCI DSS certification.Experience building or restructuring a security function at a mid-sized organization; fintech or digital payments background.Technical depth to challenge vendor and engineering reports on network/cloud architecture, application/API security, data protection, DevSecOps and incident investigation.Who We Are Looking ForSomeone who can set strategy and also drive execution, think in terms of risk, and stay calm and decisive during serious incidents. You balance security, compliance, product velocity, customer experience and cost, and you take ownership until risks are closed out.What We OfferAbove-market competitive compensation, negotiated based on your capabilities.A CISO role with real standing: direct reporting line to the CEO, a seat on the Security Council, and authority matching your responsibilities.Quarterly and annual performance bonuses tied to results, with no cap based on capability; annual salary review.Training and certification budget (CISSP, CISM, SANS, etc.) and support for professional development.Large-scale projects, high-volume data systems and modern technology platforms.Social insurance, private health insurance, and regular health check-ups.2 WFH days per month, at least 12 days of annual leave, and a paid birthday day off.Company-sponsored clubs (football, dance, yoga, badminton and more).📍 Location: Hanoi, Vietnam