Vice President, Information Security

As VP, Information Security, this role will lead the bank’s cybersecurity strategy, engineering, and operations to protect our Digital Banking platforms, customers, and data across Corporate and Retail Banking. The role owns cloud security, security engineering, vulnerability management, compromise assessment, and the Security Operations Centre (SOC) for a 100% cloud-native bank running on Google Cloud, Databricks, Kafka, and a next-generation core banking platform, and is accountable for keeping the bank continuously ready for State Bank of Vietnam, CIMB Group, PCI DSS, and audit scrutiny. It will build and lead in-house and managed security teams, enable the launch of Digital Banking and the governed adoption of AI at speed, and report cyber risk posture, KPIs, and investment priorities to senior management, the Board, and CIMB Group.Key ResponsibilitiesOwn security strategy and governanceAuthor and execute the bank’s cybersecurity strategy, multi-year Security Master Plan, and Zero Trust roadmap in line with the bank’s digital ambitions, CIMB Group standards, and approved risk appetite. Maintain the information security policy stack and standards against ISO/IEC 27001:2022, NIST CSF 2.0, and CIS Controls v8, and report security posture, KPIs, and key risk indicators to senior management, the Board (at least quarterly), and CIMB Group.Secure the cloud-native bankBe accountable for security across the bank’s Cloud environment and SaaS services (e.g. Microsoft 365), including landing zone and organisation guardrails, cloud identity, network segmentation, key management and encryption, Kubernetes/GKE and container security, CSPM/CNAPP, and secure configuration baselines enforced as policy-as-code.Lead security engineering and DevSecOpsPerform security architecture reviews and threat modelling for new digital platforms and major changes, and embed DevSecOps gates (SAST/DAST/SCA, secrets management, IaC and container scanning, software supply chain controls) in CI/CD pipelines. Direct identity and privileged access management (MFA, vaulting, session recording, credential rotation) and secure the data and integration platforms, including Databricks, Kafka, API gateways, and SunLine iCore touchpoints.Secure Digital Corporate and Retail BankingDrive security-by-design for the Wholesale Digital Banking programme, covering corporate entitlements, maker-checker and multi-level approval workflows, host-to-host/API connectivity, client ERP integration, cash management, trade finance, and corporate lending. Partner with Fraud and Digital Channels to strengthen customer authentication, device binding, mobile app protection, and anti-phishing and anti-malware controls for retail journeys.Own vulnerability and exposure managementRun the end-to-end vulnerability management programme across cloud, applications, APIs, endpoints, and third-party components, including asset discovery, authenticated scanning, CVSS- and risk-based prioritisation, remediation SLAs, exception management, external attack surface monitoring, and penetration testing and red teaming across all key projects.Lead compromise assessment and threat huntingConduct periodic compromise assessments and a regular threat hunting cadence across cloud, identity, endpoint, network, and application layers to uncover indicators of compromise, persistent threats, and control weaknesses, and turn findings into prioritised remediation and new detections.Run the SOC and incident responseLead and mature the SOC operating model (in-house, hybrid, or managed) delivering 24x7 monitoring, detection engineering, L1/L2/L3 escalation, SIEM/SOAR and EDR/XDR integration, and threat intelligence, measured by MTTD, MTTR, and MITRE ATT&CK coverage. Own cyber incident response end to end, from forensic triage and root cause analysis to recovery, regulatory and Group notification, and executive tabletop exercises.Govern and secure the use of AIDefine the AI security policy and guardrails across model, data, agent, integration, and human-oversight layers; maintain a governed inventory of AI agents and use cases; detect and manage shadow AI; and assess enterprise AI tools before rollout. Apply AI and automation to improve detection, triage, vulnerability prioritisation, and compliance work.Manage cyber risk, compliance, and regulatory engagementOwn the security risk register with named owners for every exception and the IT Risk and Control Self-Assessment aligned with CIMB Group Risk. Ensure compliance with SBV regulations (e.g. Circular 09/2020/TT-NHNN, Circular 50/2024/TT-NHNN), the Cybersecurity Law and Decree 53/2022/ND-CP, the Personal Data Protection Law, and PCI DSS v4.0, and act as primary liaison for SBV examinations, Group reviews, and internal and external audits.Manage third parties, vendors, and budgetRun security due diligence and ongoing assurance for outsourced providers, cloud and SaaS vendors, fintech partners, and MSSPs, including contractual security and assessment rights. Own the security CAPEX and OPEX budget, build investment cases with cost, ROI, and risk-reduction modelling, and keep security operating costs under control.Build a high-performing security organisationRecruit, develop, and retain security engineers, SOC analysts, threat hunters, and GRC specialists, and manage managed-service partners. Build a strong security culture across the bank through awareness programmes and secure development training for engineering teams, with clear succession for key roles.Job SpecificationBachelor’s degree in Computer Science, Information Security, Information Technology, Engineering, or a related field; Master’s degree is an advantage.Relevant professional certifications (e.g., CISSP, CISM, CRISC, CCSP, ISO/IEC 27001 Lead Auditor, CEH, OSCP, GIAC, PCI DSS, Google Cloud Professional Cloud Security Engineer) would be an added advantage; active progress toward CISSP or CRISC will be considered.Minimum 12 years of experience in cybersecurity, information security, and IT governance, including at least 8 years in senior security leadership roles and at least 3 years in a banking or SBV-regulated financial services environment (banks, digital banks, e-wallets, or payment intermediaries).Strong experience in cloud security across major public cloud platforms (AWS, Azure, and/or GCP) and enterprise SaaS at scale; hands-on GCP experience is an advantage.Proven security engineering experience, including security architecture, design reviews, and threat modelling for digital banking platform builds, DevSecOps in CI/CD pipelines, and IAM/PAM.Proven track record in enterprise vulnerability management, penetration testing, compromise assessment, threat hunting, and digital forensics, including owning real-world major incidents end to end.Strong experience building, operating, or managing a SOC, including SIEM (e.g. Splunk, Microsoft Sentinel, Google SecOps), detection engineering, EDR/XDR, and MITRE ATT&CK-based coverage.Direct experience with SBV supervision and examinations, PCI DSS compliance, and ISO/IEC 27001 certification; experience within a regional banking group is an advantage.Technical skills:Cloud security & cloud-native platformsStrong knowledge of securing public cloud, Kubernetes, microservices, APIs, and data and streaming platforms (e.g. Kafka, Databricks) at scale.Security engineering & architectureExpert in security architecture, threat modelling, DevSecOps, Zero Trust, IAM/PAM, network, and endpoint security.Vulnerability & threat managementExpert in risk-based vulnerability and exposure management, penetration testing, compromise assessment, and threat hunting.Security operations & incident responseStrong experience in SOC operations, SIEM/SOAR, EDR/XDR, detection engineering, digital forensics, and crisis management.AI & emerging technology securityGood knowledge of AI/GenAI and AI security governance, including LLM and AI agent guardrails, shadow AI, and frameworks such as OWASP Top 10 for LLM Applications and NIST AI RMF.Governance, risk & regulatory complianceSolid knowledge of ISO/IEC 27001:2022, NIST CSF 2.0, CIS Controls v8, PCI DSS v4.0, SBV regulations, and the Personal Data Protection Law, with understanding of digital banking architecture and payments.Soft skills:Leadership & team buildingProven experience building security functions and leading in-house and managed security teams, and developing security talent.Executive & Board communicationAbility to explain cyber risk in business terms and report posture, incidents, and investment cases to senior management, the Board, CIMB Group, and regulators.Influence & challengeAbility to challenge technology, product, and vendor teams on security risks and drive remediation with owners outside the direct reporting line.Composure & decision making under pressureStructured, calm approach to incidents, escalations, and trade-offs, with the ability to make sound decisions quickly.Pragmatic risk mindset & integrityRisk-based judgement that balances security with delivery speed and customer experience, with high integrity and transparency in reporting.