Onerway is hiring a Singapore-based Head of Technology Risk & Security to own information security, cyber defence and technology risk for a PCI DSS certified cross-border payments platform operating in Singapore, the UK, Hong Kong and Europe.
About the role
Onerway operates a PCI DSS certified cross-border payments platform with business in Singapore, the UK, Hong Kong and Europe, and engineering teams in Shanghai and Wuhan and a new technology team being built in Singapore. There is no separate CISO: this role is the senior owner of security and technology risk for the group, reporting to the CIO, with a dotted line to the CEO and the board, and accountable for how the platform is defended, governed and evidenced to regulators, card schemes and partner banks.
This is a hands-on leadership role. You will set the security strategy, and you will also be close enough to the work to review an architecture, triage an incident or challenge a pen-test finding yourself. You will start with a small team and grow it as the Singapore function scales.
Key responsibilities
Security strategy and governance
- Define and own the group security and technology risk strategy, roadmap and budget, aligned with the regulatory requirements of each location we operate in and the CIO's technology plan.
- Maintain the security policy and control framework (access, cryptography, change, incident, data protection) and make it workable for engineering teams across Singapore, Shanghai and Wuhan.
- Report risk posture, incidents and remediation progress to the CIO, and through the dotted line to the CEO and the board, with direct escalation of material risks.
Hands-on security operations
- Lead detection and response: SIEM and log monitoring, alert tuning, incident handling, post-incident reviews and tabletop exercises.
- Run vulnerability and patch management, penetration testing, red-team and bug-bounty style programmes, and drive findings to closure.
- Embed security into delivery: threat modelling, secure code review, SAST/DAST, dependency and secrets scanning in CI/CD, and approval gates for high-risk releases.
- Own cloud and infrastructure security baselines, network segmentation, endpoint security, identity and privileged access management.
Technology risk management
- Operate the technology risk register, risk and control self-assessments, and key risk indicators; challenge and track remediation with system owners.
- Govern business continuity, disaster recovery and resilience testing for critical payment services: set RTO and RPO requirements, approve test plans and scope, independently review test results and remediation, and report to management and regulators. SRE executes the drills.
- Review architecture and change proposals for new products and channels, and give clear risk-based sign-off or conditions.
Regulatory and compliance
- Own compliance with the technology risk, cyber security and incident notification requirements of the regulators in each location we operate in (Singapore, the UK, Hong Kong and Europe), and track regulatory changes.
- Maintain the platform's PCI DSS certification, run assessments against ISO 27001 style controls, and manage external auditors, card scheme and partner bank security questionnaires.
- Work with Legal and Compliance on data protection across jurisdictions (Singapore PDPA, GDPR, China data laws), including cross-border data transfer controls.
Third parties, people and culture
- Assess security and resilience of cloud providers, processors, channel partners and critical vendors, and monitor them through the contract lifecycle.
- Build and lead the security and risk team; set up working models with engineers and operations in China and mentor them to a common standard.
- Run security awareness and phishing programmes, and make secure-by-default the easiest path for developers.
Requirements
- 5 to 10 years in information security, cyber security or technology risk, with at least 3 years running security operations or a security function in a regulated financial institution, payments company or fintech.
- Proven hands-on experience in incident response, vulnerability management, cloud security (Azure and AWS), IAM/PAM and secure SDLC, not only policy and oversight.
- Working knowledge of financial services technology risk and cyber regulation across more than one jurisdiction (for example MAS TRM, and UK or EU operational resilience requirements), plus hands-on PCI DSS experience and at least one of ISO 27001, SOC 2 or NIST CSF.
- Experience reporting risk clearly to senior management and regulators, and challenging engineering teams without slowing delivery.
- Track record of building or leading a small team, and of working across time zones with remote engineering teams.
- Based in Singapore, with the right to work here. Occasional travel to Shanghai and Wuhan.
- Fluent English and Mandarin (required), for working daily with the China-based teams.
Nice to have
- CISSP, CISM, CISA, CCSP, OSCP or equivalent.
- Experience with card issuing, acquiring or payment gateway security.
- Experience securing wallet, key management or digital asset custody infrastructure.
- Experience applying AI-assisted security tooling and securing AI and LLM applications.
- Prior exposure to regulator examinations in more than one jurisdiction and to external audit cycles.