Senior Manager, Information Security
Executive-level security governance role at Tranglo, a Malaysian fintech: leads the enterprise ISMS, drives ISO 27001:2022 recertification, ensures BNM RMiT and PDPA compliance, manages the enterprise risk register and vendor security, and advises the C-suite and Board on cyber risk while overseeing the Information Security Manager.
- Compensation
- Not disclosed
- Location
- Kuala Lumpur City Centre, Kuala Lumpur
- Work setup
- Onsite
- Seniority
- Senior
- Employment
- Not specified
- Experience
- 3+ years
- Category
- Security
- Posted
Skills
Must have
- Bachelor's or Master's degree in Information Security, Cybersecurity, Computer Science, or related field
- 8-10+ years in Information Security with 3-5+ years in strategic leadership or governance
- Mandatory background in Financial Services, Fintech, or Banking sector
- Proven experience leading an ISO 27001:2022 certification or transition audit
- At least one active executive security certification: CISSP, CISM, or CRISC
- Expert-level understanding of BNM RMiT guidelines
- Strong command of enterprise architecture, cloud security (AWS/Azure/GCP), and secure application development frameworks
- Ability to translate complex technical cyber threats into business risk language for executives
- Advanced stakeholder management across all levels up to the Board
- Strategic critical thinking and holistic problem-solving
- Detail-oriented execution on regulatory frameworks, contracts, risk registers, and audit evidence
- Exceptional written and verbal executive communication
Nice to have
- ISO/IEC 27001:2022 Lead Auditor or Lead Implementer certification
Full description
Tranglo is seeking a highly strategic and experienced Senior Manager, Information Security to lead our enterprise security governance, risk management, and compliance initiatives. In this executive-level role, you will serve as the primary advisor to the C-suite and Board of Directors on all matters related to cyber risk and regulatory alignment.
This role is strictly focused on strategic architecture, regulatory compliance (specifically BNM RMiT), and overseeing the successful transition and recertification of ISO 27001:2022. You will design the overarching Information Security Management System (ISMS) framework and provide strategic oversight to the Information Security Manager, who remains responsible for day-to-day technical enforcement and internal operations.
Key Responsibilities1. Strategic Governance & ISMS Architecture
- Lead, architect, and manage Tranglo’s enterprise-wide Information Security Management System (ISMS).
- Drive the implementation and continuous certification of the ISO/IEC 27001:2022 standard, serving as the primary point of contact for external auditors and certification bodies.
- Define and publish enterprise security policies, standards, and strategic objectives that align with Tranglo’s fintech business goals and risk appetite.
2. Regulatory Compliance & Enterprise Risk Management
- Ensure absolute alignment and compliance with Bank Negara Malaysia (BNM) Risk Management in Technology (RMiT) requirements, the Personal Data Protection Act (PDPA), and other relevant global financial regulations.
- Own and maintain the enterprise Information Security Risk Register, ensuring risks are accurately identified, assessed, and treated (Accept, Mitigate, Transfer, Avoid).
- Present periodic cyber risk postures, threat landscapes, and compliance dashboards directly to the ISMS Committee, C-suite, and Board of Directors.
3. Third-Party & Supply Chain Security Leadership
- Design and oversee the enterprise Third-Party Vendor Security Management framework.
- Serve as the final escalation point for critical vendor risk assessments, working with Procurement, HR-Admin, and respective DICs to govern "Gate 0" triage and risk acceptance workflows.
- Advise the ISMS Committee on supply chain vulnerabilities and cloud service risks.
4. Leadership & Departmental Oversight
- Provide strategic direction, mentorship, and high-level oversight to the Information Security Manager and operational security team.
- Delineate clear boundaries between strategic governance (owned by this role) and tactical/technical security operations (owned by the InfoSec Manager).