Tuyển dụng Head of Information Security Cybersecurity/SIEM tại Hà Nội

Role Purpose
The Head of Information Security is responsible for leading the overall information security agenda across VPBanks Securities, ensuring that the company’s technology platforms, trading
systems, customer data, digital channels, cloud environments, business operations, and third- party ecosystems are protected against evolving cyber and information security risks.
This role plays a strategic and enterprise-wide leadership role in supporting VPBanks Securities’ ambition to become a leading securities and digital investment platform in Vietnam. The position is accountable for building a mature, resilient, scalable, and business-enabling information security capability that supports digital trading growth, cloud adoption, data-driven services, regulatory compliance, and operational resilience.
Key Responsibilities

Information Security Strategy and Governance

• Develop and execute the enterprise information security strategy aligned with VPBanks Securities’ business strategy, digital transformation roadmap, technology modernization,
  and risk appetite.
• Establish and maintain information security governance frameworks, policies, standards, procedures, and control requirements across the company.
• Define the information security target operating model, including people, process, technology, governance, metrics, and accountability.
• Provide strategic advice to senior management on cyber risk, information security priorities, regulatory expectations, and investment requirements.
• Drive a security-by-design culture across technology, product, operations, digital platforms, cloud, data, and third-party ecosystems.

Enterprise Security Assurance

• Lead the overall security assurance program for trading platforms, core securities systems, customer portals, mobile applications, APIs, infrastructure, cloud platforms, data platforms, and critical business services.
• Oversee security reviews and risk assessments for new products, digital investment services, technology initiatives, outsourcing arrangements, vendor integrations, and
  major transformation programs.
• Ensure appropriate security controls are embedded throughout the system development lifecycle, change management process, cloud adoption journey, and production
  operations.
• Manage vulnerability management, penetration testing, red team exercises, secure code review, configuration review, and remediation governance.
• Establish measurable security control assurance and reporting mechanisms for executive-level visibility.

Cloud and Digital Security

• Lead the security strategy and control framework for cloud adoption, including public cloud, private cloud, hybrid cloud, container platforms, DevSecOps, cloud-native
  applications, and cloud infrastructure.
• Define cloud security standards covering identity, network security, data protection, encryption, key management, monitoring, workload protection, configuration baseline,
  and compliance.
• Partner with technology, digital product, and trading platform teams to enable secure, scalable, and resilient digital services.
• Ensure that cloud and digital initiatives meet internal security requirements, regulatory obligations, and industry good practices.

Security Operations and Incident Response

• Oversee security monitoring, threat detection, incident response, cyber crisis management, and security operations capabilities.
• Ensure effective operation and continuous improvement of SOC, SIEM, SOAR, EDR/XDR, threat intelligence, DLP, WAF, IAM, PAM, network security, and related
  security technologies.
• Lead the development and testing of cyber incident response plans, playbooks, escalation processes, and post-incident review practices.
• Coordinate with internal stakeholders, regulators, exchanges, depository/clearing institutions, external partners, and law enforcement agencies where required during
  major security incidents.
• Strengthen VPBank Securities’ cyber resilience through proactive threat hunting, attack simulation, crisis drills, and lessons learned.

Regulatory Compliance and Risk Management

• Ensure compliance with applicable requirements from the State Securities Commission of Vietnam, Vietnam Exchange, HOSE, HNX, VSDC, cybersecurity and data protection laws, and other relevant financial market regulations.
• Align the company’s information security practices with recognized standards and frameworks such as ISO 27001, NIST CSF, CIS Controls, PCI DSS, and other applicable frameworks.
• Work closely with Enterprise Risk Management, Operational Risk, Compliance, Legal, Internal Audit, and Technology Risk teams to manage information security risk across
  the company.
• Support internal and external audits, regulatory inspections, and remediation programs related to information security.
• Maintain effective risk reporting, issue tracking, and remediation governance for executive committees.

Data Protection and Identity Security

• Lead security initiatives related to customer data protection, transaction data security, data classification, data loss prevention, encryption, privacy protection, secure data
  sharing, and sensitive data handling.
• Strengthen identity and access management practices, including privileged access management, access governance, authentication, authorization, and zero trust principles.
• Ensure that customer data, trading data, employee data, partner data, and confidential business information are adequately protected across systems, channels, and third
  parties.
  Third-Party and Ecosystem Security
• Establish security requirements and assessment processes for vendors, outsourcing partners, fintech partners, market data providers, cloud service providers, technology suppliers, and ecosystem partners.
• Oversee third-party security risk assessments, contract security requirements, ongoing monitoring, and remediation follow-up.
• Ensure that external dependencies do not create unacceptable cyber, operational, regulatory, or reputational risks for the company.

Leadership and Capability Building

• Lead, develop, and mentor the information security team, building strong capabilities across governance, architecture, assurance, operations, cloud security, application security, incident response, and risk management.
• Build a high-performance security culture with clear ownership, accountability, collaboration, and continuous improvement.
• Design and deliver security awareness programs for employees, management, technology teams, and business units.
• Manage security budgets, resource planning, vendor performance, and capability development roadmaps.

• Bachelor’s degree or higher in Information Security, Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline.
• Minimum 10 years of experience in information security, cybersecurity, technology risk, or related fields, with at least 5 years in a leadership or management role.
• Strong experience in securities, capital markets, financial services, fintech, digital investment platforms, or large-scale enterprise technology environments.
• Proven experience in developing and implementing enterprise-wide information security strategy, governance, operating models, and security programs.
• Strong understanding of securities technology architecture, online trading platforms, core securities systems, market connectivity, APIs, cu