Sr. Security Analyst - APAC & Japan

About this role

• Manage and implement security Governance, Risk and Compliance (GRC) for our wide variety of client delivery engagements within the region, including banking, insurance, mining, telco and public sectors.
• Observe and apply regional and international cyber security and privacy laws, frameworks and standards such as ISO 27001, NIST-CSF, APRA CPS, Privacy Act, GDPR, IRAP ISM, PSPF, CII and Essential Eight.
• Work with the Business Information Security Officer (BISO) and affiliated Centre of Excellence (CoE) leaders to ensure organisational practices align with business objectives and evolving threat landscape.
  
  

• Engage with variety of stakeholders: business leaders, auditors, customer security officers, legal, HR, and IT teams to understand security requirements and risk scenarios.
• Apply end-to-end risk management principles guided by business context and risk appetite. Identify, assess and respond to risks.
• Develop security management and data protection plan for key accounts: identify assets & threat vectors. Define mitigations and control framework.
• Conduct periodic risk and control assessments of our adherence to obligations and security management plan. Provide implementation plans to close gaps.
  
  

• Manage third party or client audit/security assessment activities such as SOC report, PCI-DSS and ISO 27001. Plan audit scope and schedule, and coordinate with various corporate functions to collect/produce evidences.
• Assist delivery team to review Technical Solution Designs and Secure SDLC processes to ensure IT products and services are foundationally secure in accordance to risk appetite.
• Coordinate corporate incident management response and support investigations within a strict timeframe. Liaise with customers and external parties.
• Develop Security Training and Awareness materials, and conduct or facilitate awareness sessions.
  
  

• Bachelor’s degree or above in a related field or an equivalent experience
• 2-5 years of IT or Security experience
• Preferable to have an experience in working for a regulated industry
• Preferable to have an experience in Software Development and/or Infrastructure Build
• Preferable to have attained certifications such as ISO 27001, CISA, or CRISC; or an intend to get one.
• Preferable to have some knowledge in security frameworks such as ISO 27001, NIST-CSF, ISM, PSPF, etc.
• Knowledge in Security Architecture or Project Management or experience will be highly regarded