Overview
Information Security Lead Jobs in Singapore, Singapore at Bond Financial Group
Title: Information Security Lead
Company: Bond Financial Group
Location: Singapore, Singapore
The Information Security (InfoSec) Lead is a senior player-manager responsible for establishing and owning the information security policy framework and ISMS. This role leads ISO 27001:2022 certification, governs identity and access management, and ensures security standards are embedded across all engineering teams.
Key Responsibilities
Security Policy and ISMS Ownership
- Establish and maintain the information security policy framework, ISMS risk register, risk treatment plan, and Statement of Applicability (SoA).
- Lead the organisation through ISO 27001:2022 certification and ongoing surveillance audits; coordinate all departments on control implementation and evidence.
- Conduct periodic policy reviews to ensure alignment with regulatory requirements and evolving threat landscapes.
Identity, Access and Secure Development
- Design and implement IAM controls including SSO, MFA, and PAM; govern user provisioning and access review processes.
- Define secure development standards (e.g. OWASP); conduct security architecture reviews with the Applications Lead.
- Configure and maintain email security gateways and endpoint protection platforms.
Security Operations Oversight and Support
- Provide strategic direction and escalation support to the Senior Security Engineer and SoC team.
- Review security incident post-mortems and ensure effective remediation.
- Manage security service providers and vendors, including MSSPs and penetration testing firms.
- On-call availability is required to support 24×7 incident response coverage.
Requirements
Experience
- 10+ years of progressive information security experience, with 3+ years in a lead or management role.
- Demonstrated experience designing and implementing an ISMS and leading ISO 27001:2022 certification programmes.
- Experience establishing IAM frameworks (SSO, MFA, PAM) and managing external audits and regulatory examinations.
- Proven experience leading incident response, containment, and post-incident reviews in a production environment.
- Experience managing MSSPs, penetration testing firms, and security tooling vendors; regulated industry background preferred.
Technical Skills
- ISMS design and operation: risk register, SoA, control framework, continual improvement
- IAM platforms: SSO (e.g. Okta, Azure AD or equivalent), MFA, PAM (e.g. CyberArk, BeyondTrust, or equivalent)
- Secure development frameworks: OWASP, SANS CWE Top 25
- Security architecture review methodologies and threat modelling
- Email security gateways and endpoint protection platforms
- ISO 27001:2022 control framework implementation across all domains
Qualifications
- Bachelor's degree or higher in Information Security, Computer Science, or a related discipline.
- CISSP or CISM strongly preferred.
