VPBank Securities (VPBS)

Tóm tắt công việc

Role Purpose

The Head of Information Security is responsible for leading the overall information security agenda across VPBanks Securities, ensuring that the company’s technology platforms, trading systems, customer data, digital channels, cloud environments, business operations, and third- party ecosystems are protected against evolving cyber and information security risks.
This role plays a strategic and enterprise-wide leadership role in supporting VPBanks Securities’ ambition to become a leading securities and digital investment platform in Vietnam. The position is accountable for building a mature, resilient, scalable, and business-enabling information security capability that supports digital trading growth, cloud adoption, data-driven services, regulatory compliance, and operational resilience.

Key Responsibilities

Information Security Strategy and Governance

• Develop and execute the enterprise information security strategy aligned with VPBanks Securities’ business strategy, digital transformation roadmap, technology modernization, and risk appetite.
• Establish and maintain information security governance frameworks, policies, standards, procedures, and control requirements across the company.
• Define the information security target operating model, including people, process, technology, governance, metrics, and accountability.
• Provide strategic advice to senior management on cyber risk, information security priorities, regulatory expectations, and investment requirements.
• Drive a security-by-design culture across technology, product, operations, digital platforms, cloud, data, and third-party ecosystems.

Enterprise Security Assurance

• Lead the overall security assurance program for trading platforms, core securities systems, customer portals, mobile applications, APIs, infrastructure, cloud platforms, data platforms, and critical business services.
• Oversee security reviews and risk assessments for new products, digital investment services, technology initiatives, outsourcing arrangements, vendor integrations, and major transformation programs.
• Ensure appropriate security controls are embedded throughout the system development lifecycle, change management process, cloud adoption journey, and production operations.
• Manage vulnerability management, penetration testing, red team exercises, secure code review, configuration review, and remediation governance.
• Establish measurable security control assurance and reporting mechanisms for executive-level visibility.

Cloud and Digital Security

• Lead the security strategy and control framework for cloud adoption, including public cloud, private cloud, hybrid cloud, container platforms, DevSecOps, cloud-native applications, and cloud infrastructure.
• Define cloud security standards covering identity, network security, data protection, encryption, key management, monitoring, workload protection, configuration baseline, and compliance.
• Partner with technology, digital product, and trading platform teams to enable secure, scalable, and resilient digital services.
• Ensure that cloud and digital initiatives meet internal security requirements, regulatory obligations, and industry good practices.

Security Operations and Incident Response

• Oversee security monitoring, threat detection, incident response, cyber crisis management, and security operations capabilities.
• Ensure effective operation and continuous improvement of SOC, SIEM, SOAR, EDR/XDR, threat intelligence, DLP, WAF, IAM, PAM, network security, and related security technologies.
• Lead the development and testing of cyber incident response plans, playbooks, escalation processes, and post-incident review practices.
• Coordinate with internal stakeholders, regulators, exchanges, depository/clearing institutions, external partners, and law enforcement agencies where required during major security incidents.
• Strengthen VPBank Securities’ cyber resilience through proactive threat hunting, attack simulation, crisis drills, and lessons learned.

Regulatory Compliance and Risk Management

• Ensure compliance with applicable requirements from the State Securities Commission of Vietnam, Vietnam Exchange, HOSE, HNX, VSDC, cybersecurity and data protection laws, and other relevant financial market regulations.
• Align the company’s information security practices with recognized standards and frameworks such as ISO 27001, NIST CSF, CIS Controls, PCI DSS, and other applicable frameworks.
• Work closely with Enterprise Risk Management, Operational Risk, Compliance, Legal, Internal Audit, and Technology Risk teams to manage information security risk across the company.
• Support internal and external audits, regulatory inspections, and remediation programs related to information security.
• Maintain effective risk reporting, issue tracking, and remediation governance for executive committees.

Data Protection and Identity Security

• Lead security initiatives related to customer data protection, transaction data security, data classification, data loss prevention, encryption, privacy protection, secure data sharing, and sensitive data handling.
• Strengthen identity and access management practices, including privileged access management, access governance, authentication, authorization, and zero trust principles.
• Ensure that customer data, trading data, employee data, partner data, and confidential business information are adequately protected across systems, channels, and third parties.
  Third-Party and Ecosystem Security
• Establish security requirements and assessment processes for vendors, outsourcing partners, fintech partners, market data providers, cloud service providers, technology suppliers, and ecosystem partners.
• Oversee third-party security risk assessments, contract security requirements, ongoing monitoring, and remediation follow-up.
• Ensure that external dependencies do not create unacceptable cyber, operational, regulatory, or reputational risks for the company.

Leadership and Capability Building

• Lead, develop, and mentor the information security team, building strong capabilities across governance, architecture, assurance, operations, cloud security, application security, incident response, and risk management.
• Build a high-performance security culture with clear ownership, accountability, collaboration, and continuous improvement.
• Design and deliver security awareness programs for employees, management, technology teams, and business units.
• Manage security budgets, resource planning, vendor performance, and capability development roadmaps.

- Thu nhập hấp dẫn, lương thưởng theo performance.
- Thưởng các ngày Lễ /Tết (theo chính sách công ty từng thời kì)
- Chế độ ngày phép hấp dẫn theo từng cấp bậc
- Bảo hiểm bắt buộc theo LLĐ, BH sức khỏe cho CBNV tùy theo cấp bậc và thời gian công tác
- Được tham gia các khóa đào tạo tùy thuộc vào khung đào tạo cho từng vị trí.
- Thời gian làm việc: từ thứ 2 – thứ 6
- Môi trường làm việc năng động, thân thiện, có nhiều cơ hội học đào tạo, học hỏi và phát triển; được tham gia nhiều hoạt động văn hóa thú vị (cuộc thi về thể thao, tài năng, hoạt động team building,…)

• Bachelor’s degree or higher in Information Security, Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline.
• Minimum 10 years of experience in information security, cybersecurity, technology risk, or related fields, with at least 5 years in a leadership or management role.
• Strong experience in securities, capital markets, financial services, fintech, digital investment platforms, or large-scale enterprise technology environments.
• Proven experience in developing and implementing enterprise-wide information security strategy, governance, operating models, and security programs.
• Strong understanding of securities technology architecture, online trading platforms, core securities systems, market connectivity, APIs, customer-facing digital channels, cloud platforms, data platforms, and enterprise infrastructure.
• Hands-on leadership experience across security operations, application security, cloud security, identity security, data protection, incident response, vulnerability management, and third-party security.
• Solid knowledge of regulatory requirements and industry standards related to cybersecurity, data protection, operational resilience, and information security in financial markets.
• Experience working with senior executives, regulators, auditors, technology leaders, business units, and external partners.
• Strong leadership, stakeholder management, communication, decision-making, and problem-solving skills.