The posting
About the Role
We are seeking an experienced and hands-on Associate Director, Security to lead and strengthen the company's overall information security and cybersecurity framework.
This role will be responsible for developing and implementing security strategies, overseeing cybersecurity risk management, safeguarding critical systems and infrastructure, and ensuring the confidentiality, integrity and availability of the company's information assets.
Working closely with Technology, Infrastructure, Compliance, Risk and senior management teams, the successful candidate will drive security governance, establish robust security controls, manage security incidents and ensure that the company's technology environment remains resilient against evolving cyber threats.
The ideal candidate should possess strong technical expertise, sound knowledge of regulatory security requirements and proven experience managing information security within financial services, fintech, banking or digital asset organizations.
Key Responsibilities
1. Information Security Strategy & Governance
- Develop, implement and continuously enhance the company's information security strategy, policies, standards and governance frameworks.
- Establish security governance structures aligned with business objectives, technology architecture and regulatory requirements.
- Drive the implementation and maintenance of information security management frameworks, including ISO 27001, NIST Cybersecurity Framework and other relevant industry standards.
- Define security policies, procedures and control requirements covering information assets, systems, applications and infrastructure.
- Provide regular security risk assessments, management reporting and recommendations to senior management.
2. Cybersecurity & Infrastructure Protection
- Oversee the design, implementation and effectiveness of cybersecurity controls across the company's IT infrastructure, cloud environments, networks, endpoints and applications.
- Establish security architecture principles and ensure security is embedded throughout the system development lifecycle.
- Oversee vulnerability management, penetration testing, security assessments and remediation activities.
- Implement and monitor security solutions such as SIEM, EDR/XDR, IAM, privileged access management, network security and data loss prevention.
- Drive secure configuration management, access control reviews, encryption standards and network segmentation.
- Work closely with infrastructure and engineering teams to strengthen system resilience and reduce exposure to cyber threats.
3. Security Risk Management & Regulatory Compliance
- Conduct regular information security risk assessments and identify potential vulnerabilities, control gaps and emerging threats.
- Ensure security controls and processes comply with applicable MAS Technology Risk Management (TRM) Guidelines, relevant MAS Notices, cybersecurity requirements and other regulatory obligations.
- Support internal and external audits, regulatory inspections and security assessments.
- Establish appropriate third-party and vendor security risk assessment frameworks.
- Monitor remediation of security findings and ensure timely closure of identified control deficiencies.
- Partner with Compliance and Risk teams to ensure security governance is aligned with enterprise risk management frameworks.
4. Security Operations & Incident Management
- Establish and oversee cybersecurity monitoring, threat detection and incident response capabilities.
- Lead the investigation, containment, remediation and recovery of security incidents and cyber threats.
- Develop and maintain incident response plans, escalation protocols and security playbooks.
- Coordinate security incident simulations, tabletop exercises and business continuity testing.
- Drive threat intelligence monitoring and proactively assess potential threats affecting the financial services and digital asset industry.
- Ensure post-incident reviews are conducted and corrective actions are implemented.
5. Data Protection & Business Resilience
- Establish security controls to safeguard sensitive business information, customer data and confidential financial information.
- Oversee data classification, encryption, data access governance and secure data handling practices.
- Strengthen backup, disaster recovery and business continuity security controls.
- Work with relevant stakeholders to ensure critical business systems and services can recover effectively from cyber incidents or operational disruptions.
- Support security assessments for new products, systems, technologies and business initiatives.
6. Security Awareness & Stakeholder Management
- Develop and implement company-wide security awareness and training programs.
- Promote a strong security-conscious culture across the organization.
- Provide security advisory support to Technology, Product, Operations and business teams.
- Manage relationships with external security consultants, penetration testing providers and cybersecurity vendors.
- Lead and develop security personnel while driving accountability for security practices across the organization.
Requirements
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, Information Security or a related discipline.
- Minimum 8–12 years of relevant experience in cybersecurity, information security or IT security, preferably within financial services, banking, fintech or digital asset organizations.
- At least 3–5 years of experience in a managerial or leadership capacity overseeing security functions or cybersecurity initiatives.
- Strong knowledge of cybersecurity frameworks and standards, including ISO 27001, NIST CSF, CIS Controls and related security best practices.
- Good understanding of MAS Technology Risk Management Guidelines, cybersecurity regulatory expectations and financial services security governance.
- Hands-on experience in security risk assessments, vulnerability management, penetration testing, security incident response and security operations.
- Familiarity with cloud security architecture, network security, endpoint protection, IAM/PAM, SIEM and data protection technologies.
- Experience implementing and managing security controls across cloud and on-premises infrastructure.
- Strong understanding of secure software development practices, application security and infrastructure hardening.
- Proven ability to lead security projects, manage external security vendors and work collaboratively with cross-functional stakeholders.
- Strong analytical, problem-solving and incident management capabilities.
- Excellent communication and stakeholder management skills, with the ability to engage both technical teams and senior management.
Preferred Qualifications
- Relevant professional certifications such as CISSP, CISM, CISA, CCSP, CEH or GIAC certifications.
- Experience supporting MAS-regulated financial institutions or payment service providers.
- Experience in digital asset security, including wallet security, key management, custody infrastructure and blockchain-related security risks.
- Familiarity with cloud platforms such as AWS, Azure or Google Cloud.
- Experience establishing or maturing an Information Security Management System (ISMS).
What We Offer
- An opportunity to shape and strengthen the cybersecurity landscape of a growing fintech and digital financial services business.
- Exposure to institutional-grade payment infrastructure and digital asset ecosystems.
- Direct collaboration with senior management and technology leadership.
- Opportunities to drive strategic security initiatives and build a robust security governance framework.
- A dynamic environment at the intersection of traditional finance and emerging financial technologies.
