Chief Information Security Officer
Asia White Collar · Đống Đa, Hanoi, Vietnam
Tailor my CV for this job — freeIndustry: Fintech / Digital Payments
Reporting directly to the CEO and serving on the Information Security Council, the CISO will have the mandate to shape the company's security strategy, oversee its execution, and recommend suspending system deployments or operations when critical security risks remain unresolved.The ideal candidate combines strategic vision, technical expertise, regulatory knowledge, and strong execution capabilities.Key Responsibility1. Cybersecurity Strategy & ArchitectureEvaluate the organization's security maturity and develop a comprehensive 2–3 year cybersecurity roadmap aligned with business objectives.Define security architecture standards covering infrastructure, networks, cloud, applications, APIs, data protection, encryption, and access management.Prioritize security investments based on risk exposure, business impact, and cost efficiency.Determine the optimal combination of internal capabilities and external security solutions.2. Security Leadership & Team DevelopmentBuild, manage, and develop the company's Information Security function, comprising Governance, Risk & Compliance (GRC) and Security Operations (SecOps).Establish clear responsibilities, accountability structures, and segregation of duties in accordance with regulatory requirements.Strengthen internal cybersecurity expertise while effectively managing specialized external partners.3. Risk Management, Compliance & Data ProtectionEstablish and maintain information security policies, risk management frameworks, risk registers, and security classification documentation.Ensure compliance with applicable Vietnamese regulations, particularly State Bank of Vietnam (SBV) requirements and personal data protection legislation.Oversee data governance, encryption, Data Loss Prevention (DLP), privacy impact assessments, and data subject rights.Act as the principal cybersecurity representative in regulatory inspections, audits, and reporting to the SBV.4. Security Operations & Business ResilienceOversee continuous security monitoring and coordinate with SOC/MDR service providers to improve threat detection and incident response.Direct vulnerability management, penetration testing, Identity and Access Management (IAM), and Privileged Access Management (PAM).Lead cybersecurity incident response planning, including at least two simulation exercises annually.Collaborate with Technology and Operations teams to maintain effective business continuity and disaster recovery capabilities, including RTO/RPO requirements.5. Application Security, DevSecOps & Emerging TechnologiesIntegrate cybersecurity controls throughout the Software Development Lifecycle (SDLC).Oversee application and API security testing, threat modeling, source code security, and third-party dependency management.Establish appropriate cybersecurity governance for AI adoption and AI-enabled business processes.6. Executive Governance & Stakeholder ManagementManage cybersecurity budgets, vendor relationships, and third-party security risks.Provide quarterly security assessments and risk reports to the Information Security Council and Board of Directors.Translate complex cybersecurity issues into actionable business recommendations.Promote organization-wide cybersecurity awareness through training, phishing simulations, and Security Champion initiatives.Essential Qualifications8+ years of professional experience in information security or cybersecurity, including at least 3 years in a leadership or team management position.Proven experience in banking, financial services, fintech, payment processing, or other highly regulated digital transaction environments.Strong understanding of Vietnam's cybersecurity and information security regulatory framework, including SBV Circulars 09/2020 and 50/2024, personal data protection legislation, and information system security classification requirements.Practical knowledge of internationally recognized frameworks, particularly ISO/IEC 27001, PCI DSS, and NIST CSF.Demonstrated capabilities across both security governance (GRC) and operational security, including SOC oversight, incident management, and vulnerability assessment.Ability to evaluate external security providers, challenge technical recommendations, and oversee service delivery.Strong executive communication skills, with the ability to present cybersecurity risks and recommendations to senior leadership.Eligibility to complete required background verification procedures.Preferred QualificationsPrior involvement in implementing SBV information security regulations, particularly Circular 09/2020 or its predecessor, Circular 18/2018.Professional certifications such as CISSP, CISM, or CRISC; CISA and ISO 27001 Lead Auditor/Implementer certifications are advantageous.Experience achieving Level 3 information system security compliance, ISO/IEC 27001 certification, or PCI DSS compliance.Track record of establishing, transforming, or scaling an Information Security function.Strong technical understanding of cloud/network security, application and API protection, data security, DevSecOps, and digital forensics.Experience working directly with regulatory authorities and coordinating security inspections.Compensation & BenefitsHighly competitive compensation package, tailored to experience and professional capabilities.Executive-level authority: Direct reporting to the CEO, membership in the Information Security Council, and meaningful influence over critical security decisions.Performance-based rewards: Quarterly and annual bonuses linked to achievements, with uncapped earning potential based on performance.Career development: Annual compensation reviews, professional training opportunities, and sponsorship for industry-recognized certifications such as CISSP, CISM, and SANS.Technology exposure: Opportunities to lead large-scale security initiatives involving high-volume transaction systems and modern technology infrastructure.Comprehensive benefits: Statutory social insurance, private healthcare coverage, and annual medical examinations.Work-life balance: Two work-from-home days per month, a minimum of 12 annual leave days, and an additional paid birthday leave day.Employee engagement: Access to company-sponsored sports and recreational activities, including football, badminton, yoga, and dance.Work Location: Hanoi, Vietnam