VP, Cyber Risk Governance

A leading financial institution is looking for a VP, Cyber Risk Governance to lead cybersecurity governance, risk and controls oversight across its APAC footprint. This is a governance and oversight role, not a hands-on technical one: you'll set the standards, drive assurance outcomes, and build a strong risk and controls mindset across the business.

What you'll do

• Own and evolve the cybersecurity governance framework, policies and controls across multiple business units and jurisdictions in APAC.
• Act as the senior point of contact for external auditors and regulators on cyber and information security matters, closing out findings and keeping the business audit-ready year-round.
• Assess cyber risk and controls maturity across the region, identify gaps, and drive pragmatic, risk-based improvements.
• Track and interpret APAC regulatory requirements (e.g. BNM, RBI and equivalent regimes) and translate them into practical governance standards.
• Partner with technology, risk, legal and compliance stakeholders, and engage senior regional leadership to embed a strong governance culture.
• Build cyber governance capability across the business through structured upskilling and regular forums that keep teams current on policy and regulatory change.

What you'll bring

• Strong background in cyber risk management, IT/security governance, risk and controls, or technology audit, ideally including financial services exposure (banking an advantage, but strong non-FI candidates with the right governance exposure will also be considered).
• A governance and oversight mindset: comfortable setting and enforcing standards and interpreting risk, rather than a purely hands-on technical profile.
• Familiarity with APAC regulatory and compliance requirements across more than one jurisdiction.
• A track record of representing the business to auditors or regulators and driving issues through to resolution.
• Strong stakeholder management and communication skills, with the ability to influence senior leaders across a matrixed, multi-market organisation.
• Approximately ten to twelve years of relevant experience is typical for this level, though candidates with less can be considered if the profile is right.
• Relevant certifications (e.g. CISSP, CISA, CRISC, CGEIT) are an advantage.