Kerja Sepenuh Masa, Manager, Information Security di AIA Digital+ Federal Territory - Maukerja

Job Description

We are seeking an experienced and highly motivated Information Security Manager to lead security governance, risk management, compliance oversight, and security assurance activities across the organization. The successful candidate will be responsible for driving information security initiatives, managing security risks, overseeing audit and compliance engagements, and providing strategic security guidance to business and technology stakeholders.

This role requires strong leadership, stakeholder management, and risk-based decision-making capabilities to ensure information security risks are effectively identified, managed, and remediated. The candidate will serve as a trusted advisor to management and play a key role in strengthening the organization's security posture through governance, oversight, and continuous improvement initiatives.

Key Responsibilities

Vulnerability, Compliance, Risk and Audit Management

• Lead the implementation and continuous improvement of information security governance practices, policies, standards, and controls across the organization.
• Drive the identification, assessment, monitoring, and remediation of information security risks in accordance with organizational risk appetite and regulatory requirements.
• Review and challenge risk assessments, risk treatment plans, and risk acceptance requests to ensure risks are appropriately managed.
• Monitor the effectiveness of security controls and recommend improvements to address emerging threats and evolving business requirements.
• Provide expert security and risk advisory services to business units, project teams, and technology stakeholders.

Audit and Security Assurance Management

• Lead internal and external audits, regulatory assessments, and security assurance reviews involving information security controls and practices.
• Manage audit-related activities including stakeholder engagement, collection and review of audit evidence, preparation of management responses, and facilitation of audit meetings.
• Drive timely closure of audit findings, compliance gaps, and security control deficiencies through effective governance and stakeholder management.
• Ensure compliance with internal policies, security standards, and applicable regulatory requirements.

Security Program and Initiative Leadership

• Lead the planning and execution of information security initiatives aligned with organizational objectives and security strategy.
• Partner with business and technology teams to integrate security requirements into business processes, applications, and technology platforms.
• Drive continuous improvement initiatives to enhance security posture, operational effectiveness, and control maturity.
• Support the implementation of enterprise security programs including vulnerability management, secure development, cloud security, and third-party risk management.

Reporting, Metrics and Governance

• Develop, analyze, and present security governance reports, key risk indicators (KRIs), key performance indicators (KPIs), and compliance metrics to management.
• Produce weekly, monthly, and executive-level reporting covering risk exposure, audit observations, remediation progress, vulnerability trends, and security performance.
• Establish and maintain security dashboards to support management decision-making and governance activities.
• Provide meaningful insights and recommendations based on security metrics, audit outcomes, and risk assessments.

Stakeholder Management and Escalation

• Build and maintain strong relationships with business units, technology teams, risk management, compliance, and audit stakeholders.
• Drive accountability among stakeholders for timely remediation of security risks, audit findings, and compliance issues.
• Ensure timely escalation of material security risks, audit concerns, control weaknesses, and compliance breaches to appropriate management and governance forums.
• Act as the primary point of contact for information security governance matters within assigned business domains.

Leadership Communications and Executive Engagement

• Prepare executive presentations, management papers, and leadership decks for governance forums, management committees, audit reviews, and risk discussions.
• Communicate complex technical security risks and issues in a clear, concise, and business-focused manner.
• Present security risk assessments, compliance status, and remediation plans to senior management and key stakeholders.
• Support strategic decision-making through effective communication of security risks and recommendations.

Security Awareness and Culture

• Promote and support organization-wide security awareness initiatives to strengthen security culture.
• Provide coaching, guidance, and subject matter expertise to stakeholders on information security requirements and best practices.
• Support the development and continuous improvement of security awareness programs and training materials.

Job Requirements

• Bachelor's degree in Information Technology, Cybersecurity, Computer Science, Risk Management, or a related field.
• Minimum 8-10 years of experience in Information Security, Cybersecurity, IT Risk Management, Technology Governance, Security Compliance, or a related discipline.
• Proven experience managing information security governance, risk management, audit, compliance, or security assurance programs in a large enterprise environment.
• Strong knowledge of information security frameworks and standards including ISO 27001, NIST Cybersecurity Framework, CIS Controls, COBIT, and OWASP.
• Experience leading internal and external audits, regulatory reviews, and security assessments.
• Strong understanding of vulnerability management, risk management methodologies, and security control frameworks.
• Excellent stakeholder management, communication, negotiation, and influencing skills.
• Strong analytical, reporting, presentation, and problem-solving capabilities.
• Advanced proficiency in Microsoft PowerPoint, Excel, and reporting tools.

Preferred Certifications

• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
• CRISC (Certified in Risk and Information Systems Control)
• CISA (Certified Information Systems Auditor)
• ISO 27001 Lead Implementer or Lead Auditor

Key Attributes

• Strong leadership presence with the ability to influence and challenge stakeholders at all levels.
• Strategic thinker with strong business, technology, and risk management acumen.
• Ability to drive governance outcomes and hold stakeholders accountable for remediation commitments.
• Excellent verbal and written communication skills, including executive-level presentations.
• Highly organized and capable of managing multiple priorities in a fast-paced environment.
• Proactive, results-oriented, and able to work independently with minimal supervision.