This role is responsible for safeguarding MSIG's business, employee, and customer data across our business units (BUs) in Asia, ensuring compliance with applicable laws, regulations, and both group and local policies. It monitors the regional outsourcing framework and controls, supporting the Head of Compliance & Information Security as Data Protection Officer under Singapore's Personal Data Protection Act (PDPA) for the MSIG Asia entity. Additionally, this role supports the Compliance function as part of the second line of defence by promoting awareness and embedding a strong culture of compliance and ethical practices.
Responsibilities
- Develop and implement the annual information security action plan in collaboration with the cybersecurity team
- Develop, maintain, and support a robust incident reporting and tracking system, and regularly review, monitor, and report on corrective and improvement measures
- Monitor and advise on the effectiveness of information security workflows and controls
- Manage information security projects across Asia, including automation initiatives
- Monitor, advise, and support outsourcing activities across our BUs in Asia, and manage outsourcing requirements for the MSIG Asia entity
- Conduct annual on-site reviews of our BUs in Asia
- Support the Head of Compliance & Information Security as Data Protection Officer under Singapore's PDPA for MSIG Asia entity, including ensuring compliance, promoting a culture of data protection by communicating the policies, managing related queries and complaints, and liaising with the Personal Data Protection Commission (PDPC) as required
- Report to the Board and management on compliance with applicable laws, regulations and both group and local information security and outsourcing policies and risks
- Review, update, and maintain regional information security and outsourcing Policies, Regulations, and Guidelines (PRGs) to ensure alignment with applicable laws, regulations and both group and local policies
- Enhance information security awareness by developing training tools and materials
- Design, develop, enhance, implement, and maintain compliance and information security automated / digitalised workflow management and reporting applications
- Manage periodic reporting tools for regional monitoring, and consolidate results
- Prepare reports and documents for internal committee meetings
- Accountability for the governance and quality of the Information Asset Register (IAR), ensuring accuracy, completeness, and ongoing maintenance
- Lead and coordinate the rollout of Data Loss Prevention (DLP) tools across BUs
- Develop, implement, and maintain an AI governance framework to manage risks associated with emerging technologies, aligned with regulatory expectations and internal standards
- Serve as the Data Protection Officer (DPO) for MSIG Asia Pte Ltd, driving a strong data protection culture across the organisation
- Oversee and review Data Inventory / Data Mapping for key functions (e.g., HR)
- Partner with the Technology Solutions department on outsourcing and third-party risk management, providing solutions to mitigate information security risks in vendor arrangements
- Support the Compliance team in (1) assessing, identifying, and mitigating risks arising from Compliance Risk Assessments (CRA), Yearly Checklists (YCL), and Fraud Risk Assessments (FRA) (2) identifying, developing, and sharing best practices in compliance, fraud prevention, and internal controls (3) reviewing, monitoring, and reporting on corrective and improvement actions related to compliance audits, self-assessments, fraud/DUA incidents, regulatory sanctions and fines, and AML/CFT/sanctions-related suspicious transactions
Requirements
- Degree holder
- Professional certifications such as Certified Information Security Manager (CISM) and/or Certified Information Systems Security Professional (CISSP)
- Minimum five years of experience in information security, including regional strategy and planning, risk management and analysis, regulatory and operational compliance, and governance
- Experience in data protection / privacy and outsourcing
- Experience in compliance
- Preferably at least four years of experience in a middle management role
- Experience in project management
