Lead Security Management Engineer

About the role

Bybit is on the lookout for a Lead Security Management Engineer to spearhead our efforts in regulatory compliance and information security management. In this pivotal role, you will serve as the main point of contact for local audits and ensure that our regional infrastructure adheres to international security standards. Your expertise will be crucial in maintaining a secure environment that aligns with both local regulations and global best practices.

Key facts

What you'll do

• Act as the primary liaison with regulatory authorities such as OJK, Bappebti, and Kominfo during both remote and on-site inspections, ensuring smooth communication and compliance.
• Deliver presentations on technical architecture, security measures, and system health to external auditors, showcasing our commitment to security.
• Create and manage essential documentation, including data flow diagrams, system architecture designs, and access control records, to support compliance efforts.
• Supervise the lifecycle of regulatory inquiries, ensuring that all necessary corrective actions are completed in a timely manner.
• Stay informed about local policy changes and communicate relevant findings to the global security compliance team to adapt our strategies accordingly.
• Manage server root account access and implement robust security measures to protect sensitive information.
• Ensure that the local compliance framework aligns with the global Information Security Management System (ISMS) standards.
• Conduct thorough gap analyses to identify areas of non-compliance and implement corrective actions.
• Perform comprehensive security risk assessments and maintain up-to-date risk registers to track vulnerabilities.
• Review access control policies and permission assignments to ensure they meet security requirements.
• Lead local incident response initiatives and develop security awareness training programs for employees.
• Assess third-party vendors for potential security risks to safeguard our operations.
• Support internal and external audits for standards such as ISO 27001 and SOC2, ensuring we meet all necessary criteria.
• Facilitate penetration testing and vulnerability scanning to proactively identify and mitigate security threats.

Requirements

• A minimum of 4-5 years of experience in the fields of information security or compliance, demonstrating a solid understanding of the industry.
• A proven history of supporting regulatory audits, particularly with organizations like OJK, Bappebti, or Kominfo.
• Familiarity with security frameworks including ISO 27001, SOC2, or NIST, showcasing your knowledge of best practices.
• Competence in conducting threat assessments and managing compliance documentation effectively.
• A strong grasp of access control mechanisms, incident response strategies, and the development of security training programs.
• Proficiency in both Chinese and English, with strong skills in listening, speaking, and writing.
• Excellent cross-functional communication abilities to collaborate with various teams effectively.
• A keen eye for detail and exceptional organizational skills to manage multiple tasks efficiently.

Nice to have

• Proficiency in the Indonesian language to enhance communication with local stakeholders.
• A background in fintech, cryptocurrency, or financial services, providing relevant industry insights.
• Relevant professional certifications such as CISA, CISSP, or ISO 27001 Chief Auditor/Implementer, demonstrating your commitment to the field.
• Experience working in a multinational environment and coordinating with global headquarters, which can enhance operational efficiency.

Skills & tools

• Information Security Management Systems (ISMS)
• Regulatory Compliance (OJK, Bappebti, Kominfo)
• ISO 27001, SOC2, NIST
• Risk Assessment and Gap Analysis
• Access Control and Incident Response
• Audit Documentation and Evidence Management

Practical notes

• Bybit offers a range of benefits, including a study growth fund dedicated to your professional development, opportunities for internal mobility, and participation in global team-building events. This role not only provides a chance to advance your career but also to be part of a dynamic and innovative team committed to excellence in security management.

About the company

Bybit Fintech Limited, known as Bybit, is a Dubai based centralized cryptocurrency exchange. The platform has faced regulatory warnings in several jurisdictions.