Assistant Director, Information Security

Your tasks

Job Overview The Assistant Director, Information Security is responsible for developing, leading and continuously enhancing the organisation’s cybersecurity strategy, governance framework and security operations across corporate IT, telecommunications infrastructure, cloud platforms and customer-facing services.

The role combines strategic leadership with hands-on technical oversight across security architecture, information security governance, risk management, regulatory compliance, incident response and cyber resilience. As the organisation’s cybersecurity subject matter expert, the incumbent will safeguard critical business and network assets, drive security certifications and compliance initiatives, support customer cybersecurity requirements, and champion the adoption of security technologies and industry best practices to address evolving cyber threats.

1. Infrastructure and Network Security

• Oversee the security of telecommunications cloud infrastructure, corporate IT networks and related systems.
• Lead the architecture, implementation, management and continuous improvement of security technologies, including Next-Generation Firewalls (NGFW), Intrusion Prevention Systems (IPS), Web Application Firewalls (WAF), Anti-DDoS solutions, Active Directory (AD), TACACS+, Privileged Access Management (PAM), Multi-Factor Authentication (MFA), Endpoint Detection and Response (EDR), Endpoint Protection Platforms (EPP), Security Information and Event Management (SIEM), Zero Trust Network Access (ZTNA) and Secure Access Service Edge (SASE).
• Take ownership of security-related applications and systems, ensuring effective implementation, maintenance, operational performance and lifecycle management.
• Develop and maintain Standard Operating Procedures (SOPs), Method of Procedures (MOPs) and technical documentation for service delivery, system administration and change management.
• Lead proof-of-concept (POC) initiatives to evaluate emerging security technologies and managed security services (MSS).
• Provide Level 3 technical leadership and escalation support for security-related system issues, security operations centre (SOC) alerts and complex infrastructure security incidents.

2. Information Security Governance, Risk and Compliance

• Develop and execute the organisation’s cybersecurity strategy and roadmap to protect corporate IT, telecommunications infrastructure, applications and information assets.
• Lead the implementation, maintenance and continual improvement of the Information Security Management System (ISMS) in accordance with ISO/IEC 27001 and relevant industry standards.
• Drive security certification initiatives, including ISO 27001 and Multi-Tier Cloud Security (MTCS), where applicable, ensuring alignment with business objectives and organisational policies.
• Establish, review and maintain information security policies, standards and procedures, obtaining the necessary management approval and commitment.
• Promote compliance with information security policies and ensure that appropriate controls are implemented and consistently followed across the organisation.
• Identify and classify information assets, assess associated risks, and define appropriate application and data security controls.
• Lead risk assessments, gap analyses, compliance reviews and internal audits, and coordinate external audits and certification assessments.
• Oversee regular internal and third-party vulnerability assessments and penetration testing (VAPT), ensuring that identified vulnerabilities are assessed, prioritised, tracked and remediated in collaboration with system owners.
• Establish and monitor cybersecurity risk management processes, ensuring that security risks are appropriately documented, reported and addressed.
• Develop and deliver organisation-wide cybersecurity awareness initiatives, including training, phishing simulations and internal campaigns, to strengthen security awareness and promote a culture of cybersecurity.

3. Customer Cybersecurity Support

• Evaluate and respond to customer tenders, security questionnaires and cybersecurity enquiries relating to infrastructure security, managed security services, regulatory compliance and data privacy.
• Work closely with Sales and Solution teams to address customer security requirements, third-party risk assessments and supply chain cybersecurity obligations.
• Provide technical and governance input for customer security assessments, due diligence exercises and compliance submissions.
• Support customer engagements by articulating the organisation’s security architecture, controls, certifications and risk management practices.

4. Cybersecurity Incident Response and Resilience

• Lead the organisation’s response to cybersecurity incidents, threats and security breaches, coordinating with relevant technical and business stakeholders.
• Develop, maintain and periodically review incident response plans, SOC alert playbooks and cyber incident response procedures.
• Plan and conduct regular cybersecurity tabletop exercises and incident simulations to assess response readiness and improve organisational resilience.
• Provide investigation and remediation support to SOC and technical operations teams, ensuring timely incident containment, recovery and resolution.
• Monitor security incidents and breaches, coordinate corrective and preventive actions, and drive lessons-learned reviews to minimise recurrence.
• Strengthen cyber resilience through continuous improvement of security monitoring, incident management processes and response capabilities.
• Undertake other duties as assigned by the Head of Department.

Requirements

• Tertiary qualification in Cybersecurity, Computer Science, Information Technology, Engineering or a related discipline.
• At least 10 years of relevant experience in cybersecurity or information security, including a minimum of 5 years in a leadership, management or strategic capacity.
• Proven experience in implementing and managing an Information Security Management System (ISMS), including achieving and maintaining ISO 27001 certification.
• Strong understanding of security architecture across network, infrastructure, cloud and endpoint environments.
• Demonstrated experience in information security governance, risk management, vulnerability management, incident response and regulatory compliance.
• Experience in coordinating internal and external audits, engaging stakeholders and driving remediation of audit findings.
• Familiarity with telecommunications infrastructure, cloud security environments and enterprise IT security operations would be advantageous.
• Experience supporting customer cybersecurity assessments, tenders, security questionnaires and third-party compliance requirements.
• Professional certifications such as CISSP, CCSP, CISM, CRISC, ISO 27001 Lead Auditor or equivalent would be an advantage.

• Strong knowledge of information security frameworks and standards, including ISO 27001, MTCS and NIST.
• Hands-on technical knowledge of security technologies, including firewalls, IPS/IDS, WAF, DDoS protection, Active Directory, PAM, SIEM, EDR, ZTNA and related security solutions.
• Ability to develop and review technical design documentation, including High-Level Designs (HLDs), Low-Level Designs (LLDs), architecture diagrams and technical presentations.
• Strong leadership, team management and technical decision-making capabilities.
• Excellent written and verbal communication skills, including technical report writing and presentations to senior management.
• Strategic thinking, analytical problem-solving and effective cybersecurity risk mitigation skills.
• Strong stakeholder management and collaboration skills, with the ability to work effectively across technical teams, business functions, auditors, customers and external service providers.
• Ability to translate business requirements and cybersecurity risks into practical, sustainable security solutions.
• Adaptability and the ability to manage multiple priorities in a fast-paced, evolving environment.