The Global Head, Group IT Securityis accountable for defining, leading, and executing DKSH's enterprise-wide cybersecurity strategy to protect the confidentiality, integrity, and availability of digital assets, data, and systems across all markets and business units.
This role combines Group-level strategic leadership with hands-on executive accountability for cybersecurity governance, risk management, security operations, architecture, and resilience. Acting as DKSH's de‑facto Chief Information Security Officer (CISO), the position serves as the primary authority on cyber risk for executive management and the Board, ensuring cybersecurity enables business growth, digital transformation, and regulatory compliance across Asia and beyond.
Responsibilities
1. Cybersecurity Strategy & Executive Leadership
- Define and execute a Group cybersecurity strategy and roadmap aligned with DKSH business priorities, digital transformation, and risk appetite.
- Act as the chief cyber risk advisor to the CIO, Executive Management, and Board, translating technical risks into business impact.
- Establish measurable security outcomes, maturity targets, and KPIs aligned to industry frameworks (e.g., NIST CSF, ISO/IEC 27001).
- Position cybersecurity as a business enabler, not only a control function.
2. Cyber Risk Management & Governance
- Own the Group cyber risk management framework, including risk identification, assessment, treatment, and reporting.
- Oversee policy, standards, and exception governance to ensure consistent security controls across countries and business units.
- Lead security input into M&A, divestments, new market entry, and strategic initiatives.
- Ensure regulatory and contractual compliance across jurisdictions (e.g., data protection, client security requirements).
3. Security Operations & Incident Response
- Provide executive oversight of 24x7 security operations, incident detection, response, and recovery.
- Act as executive incident commander for major and crisis-level cyber incidents, including stakeholder and leadership communications.
- Ensure post‑incident reviews drive systemic improvement, not blame.
- Oversee threat intelligence, vulnerability management, and continuous monitoring.
4. Security Architecture, Engineering & Identity
- Govern enterprise security architecture, covering infrastructure, cloud, applications, and data platforms.
- Ensure secure‑by‑design and zero‑trust principles are embedded into technology architecture and delivery lifecycles.
- Oversee identity and access management, ensuring least‑privilege, role‑based access, and strong identity controls across the Group.
5. Data Protection, Privacy & Trust
- Ensure effective data protection, data loss prevention, and fraud prevention capabilities.
- Partner with Legal, Compliance, and Data Owners on privacy, regulatory obligations, and client assurance.
- Build and maintain external trust with customers, partners, auditors, and regulators.
6. Third‑Party & Ecosystem Security
- Own the third‑party and supply‑chain security risk program, covering vendors, partners, and managed service providers.
- Ensure security requirements are embedded into procurement, contracts, and ongoing vendor governance.
7. Organization, Talent & Culture
- Build and lead a high‑performing Group cybersecurity organization spanning Security Operations, Architecture, and GRC.
- Develop senior leaders and succession for key cybersecurity roles.
- Drive security awareness and accountability across IT and the business.
- Foster a culture of pragmatic risk management, collaboration, and continuous improvement
Requirements
Professional Experience
- 15+ years in IT and cybersecurity, with significant experience in enterprise / Group‑level leadership roles.
- Proven track record operating at CISO, Deputy CISO, or equivalent senior executive level.
- Experience managing cybersecurity across multiple countries and regulatory environments.
- Demonstrated leadership in major incident management, executive reporting, and board‑level engagement.
Technical & Professional Expertise
- Strong grounding in:
- Security operations & threat management
- Cloud, infrastructure, and application security
- Identity and access management
- Cyber risk management & governance frameworks - Deep understanding of industry frameworks and standards (e.g., NIST CSF, ISO/IEC 27001).
Leadership & Executive Skills
- Executive presence with the ability to influence without authority.
- Strong decision‑making capability in high‑pressure, ambiguous situations.
- Excellent communication skills, able to simplify complex cyber risks for non‑technical leaders.
Education
- Bachelor's degree in Computer Science, Information Technology, or related field required
- Certified Ethical Hacker (CEH) and Certified Information Security Manager(CISM) are must have
- Certified Information Systems Security Professional (CISSP) is added advantage
