Chief Information Security Officer – Indonesia

Strategic Leadership

• Define and execute the Indonesian cybersecurity and operational resilience strategy aligned with local regulatory requirements and global Binance business objectives.

• Act as the primary advisor to executive leadership and the board on information security risks and regulatory obligations in Indonesia.

• Represent Binance in engagements with Indonesian regulators including OJK Bappebti Bank Indonesia and the Ministry of Communication and Information Technology (Kominfo) on cybersecurity data protection and operational resilience matters.

• Lead the implementation of cybersecurity programs aligned with OJK Regulation on Cyber Security Management (POJK on Cyber Security) Bappebti crypto-asset regulations and PDP Law requirements.

Regulatory Compliance

• Lead the design and implementation of security frameworks and controls aligned with:

- OJK Cyber Security Management regulations and governance guidelines

- Bappebti regulations on crypto-asset trading and exchange operations

- PDP Law (UU PDP) Indonesias Personal Data Protection Law

- Bank Indonesia payment systems and electronic money regulations (as applicable)

- Kominfo regulations on electronic systems and data protection (PSE framework)

• Develop and maintain policies procedures and documentation to ensure ongoing compliance with Indonesian regulations and international standards.

• Ensure timely regulatory reporting breach notifications (including PDP Laws 72-hour notification requirement) and response to regulatory inquiries and audits.

• Liaise with Indonesian regulatory bodies and ensure proactive engagement on emerging cybersecurity requirements.

Risk & Incident Management

• Oversee risk assessments security architecture reviews and cyber risk reporting at the regional level.

• Implement and maintain incident detection and response capabilities in line with Indonesian regulatory requirements ensuring proper reporting timelines and impact assessments.

• Coordinate response to major cyber incidents affecting Indonesian operations including mandatory breach notifications to OJK/Bappebti/Kominfo as required.

• Establish and lead the Computer Security Incident Response Team (CSIRT) for Indonesian operations.

Third-Party & Supply Chain Risk

• Ensure third-party ICT service providers meet contractual and regulatory standards including oversight of cloud service providers and concentration risk assessments.

• Collaborate with procurement and legal teams to review contracts conduct due diligence and manage exit strategies in compliance with PDP Law data transfer and processor obligations.

• Manage Third party integrations risk to ensure alignment with security standards and SLAs.

Cybersecurity Operations

• Guide the security operations function in Indonesia including vulnerability management monitoring and threat intelligence.

• Partner with global SOC Security Governance and IT teams to align threat detection and response capabilities.

• Drive cyber threat & vulnerability management/penetration tests as per the regulatory framework.

• Implement robust resilience best practices to ensure that Binance products remain best in class.

Cybersecurity Governance

• Lead Security Risk Management with all stakeholders as per the Security Risk Framework.

• Accountable to the regulatory authority for all Security and IT Governance matters in Indonesia.

• Maintain and develop security governance practices including regulatory board and committee reporting.

• Work as part of the three lines of defense model to ensure funds data and systems are secure.

• Ensure all security obligations for governance regulatory and compliance matters are delivered.

• Assist the delivery of internal and external audits related to Technology and Security.

• IT security risk management for new projects and/or any integration with third-party vendors.

• Manage the local security team and contribute to continual improvement of the global department.

• Security incident management including prompt reporting to senior management and other teams.

• Facilitate continual alignment to regulatory compliance obligations and international standards.

• Fluency in English and Bahasa Indonesia; currently based in Jakarta or willing to relocate.

• Held an approved persons role within a regulated financial institution in Indonesia (preferred).

• Track record of international company experience and cyber security in a regulatory context.

• A combination of senior management and deep cyber security experience is mandatory.

• Security community contributor either through published material or international conferences.

• Demonstrable experience in a global team with a rich multicultural fast-paced environment.

• 6 years of experience in finance or a related sector focusing on security and technology compliance in a global firm.

• In-depth knowledge of Indonesian financial and data protection regulations including OJK cybersecurity regulations Bappebti rules PDP Law (UU PDP) and Kominfo PSE regulations.

• Demonstrated success in leading cross-functional cybersecurity teams across multiple jurisdictions.

• Experience managing ICT risk cyber incidents third-party vendors and penetration testing in line with regulatory standards.

• Deep understanding of Indonesian cybersecurity regulations and operational resilience principles.

• Bachelors degree or higher in information technology cyber security or related field.

• Track record in self-motivated leadership and excellent communication and listening skills.

• Proven management of cyber security operations with hands-on implementation skills.

• Delivery of best practices for international data privacy and information security frameworks.

• NIST Cybersecurity & Privacy Framework ISO 27001/ISO 27701 CIS and PCI-DSS.

• Must seek excellence by default and show a passion for collaboration and team achievement.

• Demonstrable experience delivering effective business and technical security solutions.

• A passion for the latest cyber security trends and emerging threats is essential.

• Mandatory requirement for experience engaging directly with a regulatory body (OJK Bappebti Bank Indonesia or Kominfo) and implementing regulators recommendations.

• Certifications are a plus: CISSP CISM CEH CIPP CIPM FIM ISO 27701 ISO 27001 Lead Auditor and/or ISC2 ISACA GIAC CREST.