ROLE OVERVIEW

The Chief Information Security Officer (CISO) leads CTOS Digital’s independent Second Line of Defence (2LoD) cybersecurity, information security and technology risk function within Risk & Compliance. Reporting to the Group Chief Risk & Compliance Officer, the role establishes risk governance frameworks, recommends risk appetite and minimum control requirements, provides independent review and challenge, monitors aggregate exposure and enables effective oversight by senior management and the Board.

The CISO does not own, operate or direct day-to-day technology delivery, cybersecurity operations or first-line controls. Accountability for systems, architecture, engineering, security operations, identity and access administration, vulnerability remediation, incident response execution, business continuity execution, vendor management, regulatory submissions and corrective actions remains with the relevant First Line of Defence (1LoD) executives and control owners.

The CISO may advise, review, challenge, monitor and escalate, but must not design or implement controls on behalf of 1LoD, approve matters for which 1LoD is accountable, or provide independent assurance over controls designed or operated by the 2LoD team.

SECOND-LINE MANDATE AND ACCOUNTABILITY BOUNDARIES

•2LoD owns: risk governance frameworks, policies, minimum control requirements, risk methodologies, independent monitoring plans, risk opinions, challenge, escalation and second-line reporting.

•1LoD owns: technology and security strategy execution, budgets, systems, data, processes, control design and operation, control testing, risk identification, incident response, remediation, vendor performance, resilience execution and the completeness and accuracy of management or regulatory submissions.

•Decision rights: the CISO recommends or challenges risk acceptance and exceptions but does not accept risk on behalf of the business. Acceptance must be approved by the designated 1LoD risk owner and governance authority within delegated limits.

•Incident role: 1LoD leads containment, investigation, recovery, stakeholder communications and notification execution. The CISO provides independent risk advice, challenges decisions, verifies escalation and monitors closure.

•Assurance boundary: second-line monitoring does not replace first-line control ownership or testing and does not duplicate Internal Audit’s 3LoD assurance.

KEY RESPONSIBILITIES

Cybersecurity Risk Management

•Define the Group’s cybersecurity and technology risk governance strategy, policy architecture and oversight roadmap, aligned with CTOS Digital’s business strategy and enterprise risk management framework. Technology and cybersecurity execution strategies remain accountable to the 1LoD

•Recommend cybersecurity and technology risk appetite, tolerance limits, minimum control requirements and escalation thresholds for approval by the appropriate governance bodies.

•Provide independent oversight of first-line cybersecurity strategy, investment priorities and capability maturity, informed by threat intelligence, regulatory expectations and emerging technology risks.

•Advise the Group Chief Executive Officer (GCEO), GCRCO, senior leadership and relevant Board Committees on material cyber and technology risk exposures.

Technology Risk Management

•Establish and maintain a comprehensive framework covering:

oTechnology infrastructure

oCloud computing

oApplications

oData and information

oNetwork and connectivity

oEnd-user computing

oCybersecurity

oTechnology outsourcing

oEmerging technology

oIT operations and resilience

•Set the methodology and minimum standards for identifying, assessing, measuring, monitoring and reporting cybersecurity and technology risks across the Group.

•Maintain independent oversight of the Technology Risk Register, ensuring risks have clear first-line owners, credible treatment plans and timely remediation.

•Monitor KRIs, control performance, risk concentrations and trends against approved appetite and tolerance thresholds.

•Independently review and challenge first-line risk assessments, control designs, risk acceptances, exceptions and remediation timelines.

•Escalate material, overdue or out-of-appetite exposures to the GCRCO, senior management and relevant governance committees.

Cyber Threat & Security Operations Oversight

•Set oversight requirements and independently assess the adequacy and effectiveness of the Group’s cyber threat management and security operations capabilities.

•Review first-line performance across the following capabilities:

oSecurity monitoring

oThreat detection

oVulnerability intelligence

oEndpoint security

oNetwork security

oIdentify and access management

oSecurity incident management

oSecurity investigation and response

•Monitor significant cybersecurity incidents, threat exposure and first-line response performance against defined escalation and notification requirements.

•Provide independent risk advice during major cyber incidents and challenge management decisions where customer, regulatory, financial or resilience impacts may be material.

•Verify that 1LoD has escalated material incidents and executed required internal and external reporting in accordance with approved protocols; independently challenge gaps and escalate non-compliance. The CISO does not own incident-command or notification execution.

•Review post-incident analysis and independently track first-line corrective actions to closure.

Security Architecture & Technology Assurance

•Establish minimum security architecture requirements, control standards and assurance criteria against which first-line technology designs are independently assessed.

•Provide risk oversight and independent challenge for material applications, platforms, APIs, cloud environments, digital products and technology changes.

•Assess whether first-line secure development, DevSecOps and change-management controls meet approved policies and risk appetite.

•Define risk-based assurance plans and review the results of penetration testing, vulnerability assessments, control testing and security reviews performed by competent parties.

•Challenge vulnerability prioritisation, risk acceptance and remediation decisions, and escalate material exposures that remain unresolved.

Cloud & Infrastructure Security

•Set governance, risk and minimum control requirements for CTOS Digital’s cloud, infrastructure and hybrid technology environment.

•Independently review first-line cloud security architecture, configuration standards, privileged access, monitoring and resilience arrangements.

•Monitor aggregate and emerging cloud risks, challenge control gaps and oversee remediation against approved timelines.

•Assess first-line controls covering:

oCloud identities and privileged access

oEncryption

oNetwork segmentation

oData protection

oLogging and monitoring

oBackup and recovery

oCloud configuration management

Data & Information Security

•Set Group-wide information security policy and minimum control requirements covering data classification, access, encryption, retention, transfer and disposal.

•Provide independent oversight of controls protecting customer, employee, financial and commercially sensitive information.

•Partner with Legal, Compliance and the Data Protection Officer to assess compliance with applicable Malaysian privacy, cybersecurity and sector-specific requirements.

•Independently assess material data, analytics, artificial intelligence and emerging-technology initiatives against approved risk appetite and control standards.

Third Party & Technology Vendor Risk

•Set the cybersecurity and technology risk framework, due-diligence standards, risk-tiering methodology and minimum contractual control requirements for third parties.

•Independently review and challenge first-line assessments of critical vendors, cloud providers, technology partners and outsourced service providers.

•Monitor material third-party exposure, assurance results, concentration risk, exceptions and remediation progress.

•Review and challenge proposed risk acceptance decisions relating to significant outsourcing and technology arrangements and escalate matters outside approved risk appetite to the appropriate governance authorities.

•Escalate material third-party risks and overdue corrective actions to the appropriate governance forum.

Technology Resilience & Cyber Recovery

•Set technology resilience, cyber recovery and crisis-governance requirements consistent with the Group’s risk appetite and business continuity framework.

•Independently assess whether critical technology services have appropriate:

oBusiness continuity arrangements

oDisaster recovery capabilities

oBackup strategies

oRecovery objectives

oCyber recovery procedures

•Oversee and challenge first-line resilience testing, cyber crisis simulations, recovery readiness and management of identified gaps.

•Review lessons from tests and incidents and independently monitor resulting first-line improvement actions to closure.

Governance, Risk & Compliance

•Produce independent, risk-based reporting and forward-looking insights for senior management and relevant Board Committees covering:

oCybersecurity risk

oTechnology risk

oSecurity incidents

oVulnerabilities

oCritical control awareness

oRisk acceptance

oThird party risks

oRegulatory compliance

oCyber resilience

•Establish a risk-based second-line monitoring and assurance plan, avoiding duplication with first-line control testing and Internal Audit’s independent third-line assurance.

•Coordinate appropriately with Internal Audit, external auditors, regulators and assurance providers while preserving clear accountability across the Three Lines Model.

•Independently monitor management’s remediation of audit, regulatory and assurance findings, and escalate overdue or ineffective actions.

Regulatory & Industry Compliance

•Maintain authoritative knowledge of Malaysia’s cybersecurity, technology risk, personal data protection, credit-reporting and digital-services regulatory landscape, and translate new or amended obligations into Group policies, risk appetite, control standards, compliance assessments and Board reporting.

•Act as the senior second-line cybersecurity and technology risk liaison with the National Cyber Security Agency (NACSA), the Personal Data Protection Commissioner/Department, the Registrar Office of Credit Reporting Agencies under the Ministry of Finance, Bank Negara Malaysia, the Securities Commission Malaysia, Bursa Malaysia and other competent authorities, as applicable.

•Provide second-line oversight of regulatory readiness for supervisory reviews, inspections, thematic assessments, information requests and enforcement-related remediation. 1LoD and the relevant accountable functions prepare, validate and submit management responses; the CISO independently reviews and challenges their accuracy, sufficiency and sustainability.

•Establish and monitor second-line governance requirements for statutory and regulatory notifications, including reportable cybersecurity incidents, personal data breaches, material technology disruptions and other required disclosures. The relevant 1LoD and accountable Legal, Compliance or Data Protection functions own fact validation, legal review, record preparation, approval and submission within required timelines.

•Benchmark the Group’s control environment against applicable Malaysian laws, regulatory instruments and recognised standards and frameworks, including:

oCredit Reporting Agencies Act 2010 (Act 710), related regulations, guidelines and requirements issued by the Registrar Office of Credit Reporting Agencies

oPersonal Data Protection Act 2010 (Act 709), the Personal Data Protection (Amendment) Act 2024, subsidiary legislation and applicable Commissioner guidelines, including data breach notification, Data Protection Officer and cross-border transfer requirements

oCyber Security Act 2024 (Act 854), its regulations, NACSA directives, National Cyber Security Baseline and applicable Codes of Practice, where relevant

oBank Negara Malaysia’s Risk Management in Technology (RMiT) policy document and related technology, outsourcing and operational-resilience requirements, where applicable to regulated entities, services or contractual commitments

oSecurities Commission Malaysia Guidelines on Technology Risk Management and Bursa Malaysia listing, governance and disclosure requirements, where applicable

oISO/IEC 27001, NIST Cybersecurity Framework, COBIT and PCI DSS, where applicable

oAny other Malaysian regulatory, sectoral or contractual cybersecurity, technology, privacy, resilience and incident-reporting obligations applicable to the Group.

Cybersecurity Awareness & Culture

•Establish cybersecurity awareness policy, risk-based training requirements and minimum program standards.

•Require targeted training and control reinforcement for employees in high-risk, privileged or decision-making roles.

•Monitor awareness completion, phishing resilience, behavioral risk indicators and first-line corrective actions.

•Independently assess the effectiveness of awareness and culture initiatives and recommend improvements.

•Promote clear accountability for protecting CTOS Digital’s information and technology assets across all lines of defence.

WHAT DOES IT TAKE TO BE SUCCESSFUL

Qualifications

•Bachelor’s degree or higher in Cybersecurity, Information Security, Computer Science, information Technology, or related discipline

•Preferred professional certifications in CISSP, CISM, CRISC, CISA, CCSP, ISO27001 Lead Implementer / Lead Auditor, GIAC or other recognised cybersecurity certifications.

Work Experience

•15+ years of progressive experience across cybersecurity, information security, technology risk, risk governance and regulatory oversight.

•At least 5 years in a senior leadership role within a complex, regulated, data-intensive or digitally enabled organisation, experience in financial services, credit reporting, fintech or technology is strongly preferred.

•Demonstrated experience operating in a second-line risk or compliance function, including independent challenge, risk appetite, management assurance and governance reporting.

•Proven ability to advise and constructively challenge C-suite executives and present material cyber and technology risks to Board or Board Committee level.

•Substantial, hands-on experience engaging Malaysian regulators and competent authorities on supervisory reviews, regulatory examinations, incident and breach notifications, formal submissions, remediation programs and closure of regulatory findings.

Knowledge, Skills & Competencies

•Deep knowledge of cybersecurity, technology risk, cloud, application security, identity, data protection, third-party risk and cyber resilience.

•Second-Line Judgement – maintains independence, distinguishes oversight from operational ownership, and applies proportionate challenge.

•Enterprise Resilience Assurance – connects cybersecurity and technology risk with business strategy, customer trust and enterprise resilience.

•Risk Governance – translates risk appetite into policy, standards, KRIs, decision rights and escalation requirements.

•Executive Influence – constructively challenges senior technology and business leaders while enabling informed risk decisions.

•Communication – translates complex technical exposure into clear business, regulatory and Board-level language.

•Crisis Oversight – provides calm, independent risk advice and escalation during significant cyber or technology incidents.

•Collaboration – builds effective partnerships across Technology, Product, Data, Legal, Compliance, Internal Audit and business functions without compromising independence.

•Team Leadership – builds a high-performing cybersecurity and technology risk oversight team with strong technical, risk and business capability.

•Integrity and Accountability – demonstrates confidentiality, objectivity, ethical judgement and the courage to escalate material concerns.