Deskripsi Pekerjaan

Develop, enhance, and implement information security policies and SOPs aligned with regulatory requirements and the risk committee. Monitor security across on-premise and cloud infrastructure (servers, databases, networks, WAF, firewalls, VPN, API security, endpoints, IAM). Perform security risk assessments and design mitigation plans in collaboration with relevant IT teams. Handle incident response together with the CSIRT, including investigation, analysis, root cause identification, containment, eradication, recovery, and incident reporting. Conduct regular internal vulnerability assessments and penetration testing and coordinate remediation with relevant IT teams. Manage access control and privilege management for all systems and applications, including periodic user access reviews. Ensure compliance with security standards and external audits (ISO 27001, POJK, NIST, SOC2, internal audit). Support the development of the Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP). Develop and conduct security awareness training for all employees (phishing simulations, policy awareness sessions).