Chief Information Security Officer

THE ROLE We are hiring a CISO to own technology risk and cybersecurity across Presto Pay. You will be the named, accountable security leader that BNM, our Board, our banking partners and PayNet look to. The role is independent of day-to-day technology operations: you set the standard and challenge how we build and run our systems, rather than running them yourself. Requirements Governance and regulatory Design, maintain and report on our Technology Risk Management Framework, including system criticality classification, risk assessment, monitoring and key risk indicators. Own our compliance with BNM technology and cyber requirements and keep the evidence ready for supervisory review. Help the Board set technology risk appetite and a multi-year cybersecurity strategy. Report candidly to senior management and the Board on current and emerging technology and cyber risks. Act as our primary technology-risk contact for BNM, including regulatory notifications and incident reporting. Cyber resilience Establish and oversee security monitoring and incident response, from detection and containment through post-incident review and recovery, including coverage for out-of-hours and weekend operations. Oversee vulnerability management, penetration testing, identity and privileged access management, encryption and key management. Embed secure development practices across in-house and outsourced development. Oversee business continuity and disaster recovery testing for critical payment systems. Ensure customer-protection controls for digital payments, such as self-service account suspension and fraud-related security controls, are in place and tested. Third-party and payments ecosystem assurance Lead security due diligence and ongoing monitoring of technology vendors, cloud providers and outsourced development partners. Own security and compliance evidence for PayNet participation, acquiring banks, card scheme and PCI DSS obligations, and partner-bank security reviews. Work with the Compliance Officer, Risk and Internal Audit so technology, AML/CFT and operational risk are managed consistently. People and culture Build and lead the security function, using managed security services where appropriate. Run security awareness and role-based training across the company, including customer support and backend support teams. What you will deliver in your first year Validated gap analysis against BNM's technology requirements, with a Board-approved implementation plan. Documented, approved and tested risk management framework, cyber resilience framework and incident response plan. A Board-approved technology risk appetite and cybersecurity strategy. A third-party risk register covering all critical vendors, with security terms in place for outsourced development. Regular security reporting to the Board with clear key risk indicators. Clean outcomes on penetration testing, BCP/DR testing and partner-bank security reviews, with findings tracked to closure. What we are looking for Essential Bachelor's degree in computer science, information security, engineering or a related field. 7+ years in information security or technology risk, with at least 3 years owning a security function or programme. Experience in a regulated financial institution or payments company (bank, e-money issuer, payment gateway, acquirer, or similar). Working knowledge of BNM requirements on technology risk, cyber resilience, outsourcing and e-money, and of Malaysian payments infrastructure (PayNet, DuitNow QR, FPX). Demonstrated experience running incident response and presenting to a Board or senior executive audience. Professional certification such as CISSP, CISM, CISA, CRISC or CCSP. Preferred Experience with PCI DSS (QSA/ISA or hands-on compliance), ISO 27001 and similar frameworks. Experience securing cloud-hosted, API-driven platforms and outsourced software development. Prior engagement with BNM supervisors or regulatory examinations. Bilingual in English and Bahasa Malaysia and/or Mandarin. How you work Independent judgement, and the credibility to challenge engineering and business leaders. Clear risk communication to non-technical Board members. Pragmatic, risk-based prioritisation in a lean organisation. Integrity and a habit of raising bad news early. Working arrangement The role is based in Kuala Lumpur and we prefer a full-time hire. We will also consider a fractional or part-time CISO who is one named individual accountable to Presto Pay, commits a defined minimum amount of time, is reachable during security incidents including out-of-hours, and has no conflicting engagements. Any additional role held alongside this one must not compromise independence or effectiveness.