Chief Inmation Security Officer – Indonesia

Strategic Leadership

• Define and execute the Indonesian cybersecurity and operational resilience strategy aligned with local regulatory requirements and global Binance business objectives.

• Act as the primary advisor to executive leadership and the board on information security risks and regulatory obligations in Indonesia.

• Represent Binance in engagements with Indonesian regulators — including OJK, Bappebti, Bank Indonesia, and the Ministry of Communication and Information Technology (Kominfo) — on cybersecurity, data protection, and operational resilience matters.

• Lead the implementation of cybersecurity programs aligned with OJK Regulation on Cyber Security Management (POJK on Cyber Security), Bappebti crypto-asset regulations, and PDP Law requirements.

Regulatory Compliance

• Lead the design and implementation of security frameworks and controls aligned with:

  - OJK Cyber Security Management regulations and governance guidelines

  - Bappebti regulations on crypto-asset trading and exchange operations

  - PDP Law (UU PDP) — Indonesia's Personal Data Protection Law

  - Bank Indonesia payment systems and electronic money regulations (as applicable)

  - Kominfo regulations on electronic systems and data protection (PSE framework)

• Develop and maintain policies, procedures, and documentation to ensure ongoing compliance with Indonesian regulations and international standards.

• Ensure timely regulatory reporting, breach notifications (including PDP Law's 72-hour notification requirement), and response to regulatory inquiries and audits.

• Liaise with Indonesian regulatory bodies and ensure proactive engagement on emerging cybersecurity requirements.

Risk & Incident Management

• Oversee risk assessments, security architecture reviews, and cyber risk reporting at the regional level.

• Implement and maintain incident detection and response capabilities in line with Indonesian regulatory requirements, ensuring proper reporting timelines and impact assessments.

• Coordinate response to major cyber incidents affecting Indonesian operations, including mandatory breach notifications to OJK/Bappebti/Kominfo as required.

• Establish and lead the Computer Security Incident Response Team (CSIRT) for Indonesian operations.

Third-Party & Supply Chain Risk

• Ensure third-party ICT service providers meet contractual and regulatory standards, including oversight of cloud service providers and concentration risk assessments.

• Collaborate with procurement and legal teams to review contracts, conduct due diligence, and manage exit strategies in compliance with PDP Law data transfer and processor obligations.

• Manage Third party integrations risk to ensure alignment with security standards and SLAs.

Cybersecurity Operations

• Guide the security operations function in Indonesia, including vulnerability management, monitoring, and threat intelligence.

• Partner with global SOC, Security Governance, and IT teams to align threat detection and response capabilities.

• Drive cyber threat & vulnerability management/penetration tests as per the regulatory framework.

• Implement robust resilience best practices to ensure that Binance products remain best in class.

Cybersecurity Governance

• Lead Security Risk Management with all stakeholders as per the Security Risk Framework.

• Accountable to the regulatory authority for all Security and IT Governance matters in Indonesia.

• Maintain and develop security governance practices including regulatory, board and committee reporting.

• Work as part of the three lines of defense model to ensure funds, data and systems are secure.

• Ensure all security obligations for governance, regulatory and compliance matters are delivered.

• Assist the delivery of internal and external audits related to Technology and Security.

• IT security risk management for new projects and/or any integration with third-party vendors.

• Manage the local security team and contribute to continual improvement of the global department.

• Security incident management, including prompt reporting to senior management and other teams.

• Facilitate continual alignment to regulatory compliance obligations and international standards.

• Fluency in English and Bahasa Indonesia; currently based in Jakarta or willing to relocate.

• Held an approved person's role within a regulated financial institution in Indonesia (preferred).

• Track record of international company experience and cyber security in a regulatory context.

• A combination of senior management and deep cyber security experience is mandatory.

• Security community contributor either through published material or international conferences.

• Demonstrable experience in a global team with a rich multicultural fast-paced environment.

• 6+ years of experience in finance or a related sector, focusing on security and technology compliance in a global firm.

• In-depth knowledge of Indonesian financial and data protection regulations, including OJK cybersecurity regulations, Bappebti rules, PDP Law (UU PDP), and Kominfo PSE regulations.

• Demonstrated success in leading cross-functional cybersecurity teams across multiple jurisdictions.

• Experience managing ICT risk, cyber incidents, third-party vendors, and penetration testing in line with regulatory standards.

• Deep understanding of Indonesian cybersecurity regulations and operational resilience principles.

• Bachelor's degree or higher in information technology, cyber security, or related field.

• Track record in self-motivated leadership and excellent communication and listening skills.

• Proven management of cyber security operations with hands-on implementation skills.

• Delivery of best practices for international data privacy and information security frameworks.

• NIST Cybersecurity & Privacy Framework, ISO 27001/ISO 27701, CIS and PCI-DSS.

• Must seek excellence by default and show a passion for collaboration and team achievement.

• Demonstrable experience delivering effective business and technical security solutions.

• A passion for the latest cyber security trends and emerging threats is essential.

• Mandatory requirement for experience engaging directly with a regulatory body (OJK, Bappebti, Bank Indonesia, or Kominfo) and implementing regulator's recommendations.

• Certifications are a plus: CISSP, CISM, CEH, CIPP, CIPM, FIM, ISO 27701, ISO 27001 Lead Auditor, and/or ISC2, ISACA, GIAC, CREST.