Head of Cyber Governance & Data Protection

This role is responsible for leading the bank's cybersecurity governance, technology risk, regulatory compliance, and data protection functions. The role establishes enterprise-wide governance frameworks, ensures compliance with regulatory and industry standards, drives audit readiness, and provides strategic oversight of cyber risk and data protection initiatives across the organization.

Key Responsibilities

• Develop and lead enterprise-wide cybersecurity governance, technology risk, and data protection frameworks aligned with business objectives and regulatory requirements.
• Establish, review, and approve cybersecurity policies, standards, and control frameworks to ensure consistent security practices across the bank.
• Oversee compliance with regulatory requirements, including BNM RMiT, Outsourcing Policy, PDPA, PCI-DSS, SWIFT CSP, and other applicable standards.
• Lead regulatory engagements, internal and external audits, ensuring timely remediation and closure of audit findings and compliance gaps.
• Govern third-party and cloud security risk by defining vendor risk assessment methodologies, outsourcing controls, and data residency requirements.
• Monitor enterprise cyber risk through governance dashboards, Key Risk Indicators (KRIs), risk registers, and executive reporting to senior management and board committees.
• Drive enterprise security awareness, phishing simulation, data classification, and Data Loss Prevention (DLP) initiatives to strengthen the bank's cybersecurity posture.
• Provide strategic leadership by managing governance teams, budgets, resources, and technology investments while fostering a strong culture of risk management and regulatory compliance.

Key Requirements

• Bachelor's or Master's degree in Cybersecurity, Information Security, Computer Science, Risk Management, Law, or a related discipline; MBA is an advantage.
• Minimum 10–12 years of experience in cybersecurity governance, technology risk, compliance, IT audit, or information security within the banking or financial services industry.
• At least 3–5 years of leadership experience managing cybersecurity governance, compliance, or technology risk teams.
• Strong knowledge of Malaysian banking regulations, including BNM RMiT, Outsourcing Policy, PDPA, PCI-DSS, SWIFT CSP, and relevant international security frameworks.
• Proven experience leading regulatory audits, governance programs, policy development, and enterprise risk management initiatives.
• Excellent stakeholder management and communication skills with the ability to engage regulators, executive leadership, audit committees, and business stakeholders.
• Professional certifications such as **CISSP, CISM, CISA, CRISC, CGEIT, ISO 27001 Lead Auditor/Implementer, CIPP/E, CIPM, CCSK, or CCAK are highly desirable.
• Demonstrated leadership in driving governance transformation, strengthening security controls, managing enterprise risk, and influencing strategic cybersecurity decisions in a regulated financial environment.