Job Description

At AIA we\xe2\x80\x99ve started an exciting movement to create a healthier, more sustainable future for everyone.As pioneering innovators for over 100 years, we\xe2\x80\x99re now transforming our organisation to be faster, simpler and more connected. Because we want to be even better equipped to develop digital solutions and experiences that help more people live Healthier, Longer, Better Lives.To get there, we need people with tech/digital/analytics expertise and passion to help develop positive, sustainable change through digitally enhanced experiences that will impact the lives of millions of people and create a healthier future for everyone.If you believe in developing a better tomorrow, read on.About the RoleWe are seeking an experienced senior manager to lead our information security team, combining strong hands-on technical expertise as well as people management experience in the information security domain. They will lead a team to design and/or review application security including but not limited to penetration test, source code review, Cloud Security and various inter-connected application and infrastructures, especially in the area of authentication, authorization, information protection, and cryptographic controls for both on-premise and cloud environment. The role also has supervision of the AIA-SG IAM and Threat Intelligence Manager and their team.This role is responsible for providing leadership in application security review for the strategic digital solutions across technology to ensure secure solutions for business growth. The person should have solid written and verbal communication skills.WHAT YOU\xe2\x80\x99LL BE DOING:VAPTManage the AIA-SG Vulnerability Assessment and Penetration Testing team responsible for delivering the following services to AIA-SG, including Security Architecture:Application SecurityDesign and/or review application security architecture proposal for various security-driven initiatives or business-driven initiatives for on-premise and cloud environment.Manage external third-party for application penetration testing engagements.Infrastructure SecurityManage end-to-end infrastructure security activities, such as vulnerability management, servers\xe2\x80\x99 security monitoring & hardening, infrastructure as a code, etc.Design and/or review infrastructure security architecture proposal for various security-driven initiatives for on-premise and cloud environment.Cloud SecurityManage compliancy level of AIA SG cloud security assets based on ongoing regular scanning according to the defined threshold.Evaluate the security aspect of new cloud-based solutions proposed by application development team, infrastructure team, or business users.Manage various cloud security BAU activities, such as assets provisioning, deprovisioning, hardening, etc.Penetration TestingManage end-to-end application security activities, including application penetration testing, authentication / authorization design / review, and DevSecOps design & roll out.Manage Third Party relationships with industry vendors who undertake security assessment services.Oversight of annual Pen testing schedule.Information Security ArchitectureLead a team to design and/or review application security architecture proposal for various security-driven initiatives or business-driven initiatives for on-premise and cloud environment.Design and/or review authentication and authorization flow of the applications, whether it is aligned with security best practices and organization\'s IT security technology policy & procedure in terms of the strength of access controls, session management, cache management, cookie management, token management, cryptographic algorithm, and information/data protection.Assess the security aspect of new proposed application tools / platforms from application team, and relevance/consequences to existing security architecture.Work closely with application development and infrastructure team to proactively stay on top of latest secure application design to deliver thorough security recommendation aligned with organization\'s IT security technology policy & procedure.Identity and Access ManagementSupervise the AIA-SG IAM Manager and their team performing IAM Governance functions for the Business Unit.Cyber Security & Security Incident HandlingWork with Security Operation Centre (SOC) Team to ensure secure protection of AIA SG environment.Deploy new cyber security initiatives and roll out the platform together with SOC Team.Point of contact for security incident handling and investigation, starting from incident is identified, handled, and resolved.Security AdvisoryProvide feasible security recommendations or guidance based on queries / changes initiated by application development team, infrastructure team, or business users.Facilitate challenging security conversations and provide acceptable solutions where IT standards are contradicting with business demands to achieve acceptable business solutions without sacrificing security and compliance aspects.Managerial ResponsibilitiesLead promotion of activities to increase information security within your teams to embed and continuously improve adherence to good practice.Drive a continues Learning and Development program for staff training. (with inhouse and external training programs).WHAT WE ARE LOOKING FOR:University degree in one of the following or related disciplines (Computer Science, Computer Engineering, Information Security, Information Systems).Minimum 15 years of experiences of information security domain, especially in Application Security, Infrastructure Security and Cloud Security.Preferable to have application development or infrastructure operation background with hands-on experiences of designing and/or reviewing application security or infrastructure security.Hands-on information security experience in the Multiple Cloud Environment (SaaS, PaaS and IaaS) and Cyber Incident management.Certifications related to security architecture or Cloud Security is preferable, such as CCSP, Azure DevOps certification, Azure Solutions Architect certification, etc.Preferably a holder of one or more of the following information security and audit qualifications: CISSP, CISA, CRISC, CCSP.Good knowledge of latest security technologies and cyber landscape in a highly regulated industry.Good interpersonal and communication skill.Strong leadership with a high integrity, proactive mindset, and strong ownership.Working experiences in insurance / banking / IT industry is preferred.Leading DevSecOps tool experience such as Snyk, Veracode, SonarQubeInfrastructure Security: Windows, Linux, AS400.Application framework and Security: NodeJS, ReactJS, .NETSecurity Advisory and Assessment.Security Incident Management.CI/CD pipelines: Azure DevOps, Bamboo, Jenkins, GitHub, Bitbucket.Build a career with us as we help our customers and the community live Healthier, Longer, Better Lives.You must provide all requested information, including Personal Data, to be considered for this career opportunity. Failure to provide such information may influence the processing and outcome of your application. You are responsible for ensuring that the information you submit is accurate and up-to-date.

AIA