IT Security Manager - Phillip Life Assurance Public Company Limited

1. Security Governance & ISMS Management

• Develop and maintain IT Security Governance frameworks, policies, standards, and procedures to support business objectives and regulatory requirements
• Manage the IT documentation lifecycle, including IT policy and procedure announcement, version control, and periodic review to ensure documents remain current and compliant
• Facilitate IT governance assessments against ISO 27001, NIST, and other relevant frameworks, translating control gaps into practical remediation roadmaps
• Execute and coordinate the company's ISO 27001 certification work plan — coordinate gap analysis, implementation, and audit readiness

2. Response IT Audit & Regulatory Compliance

• Coordinate internal and external IT audits, ensuring timely remediation of audit findings and compliance gaps
• Support plan and document in preparing to OIC audit finding— including Annual OIC IT Audit, CRAF, IT Environment Survey, and Electronic Registration and Certificate requirements
• Respond to findings from external IT audits and regulatory reviews
• Perform account review include Active Directory account review, high-privilege account review, VPN account review

3. Cybersecurity Awareness & Training

• Design and deliver security awareness and phishing simulation programs for all staff
• Develop training materials and programs related to IT security to foster a strong security culture across the organization

4. Execute Vulnerability Assessment, Penetration Testing & Security Hardening

• Independently execute VA and Penetration Testing activities for servers, network infrastructure, applications, databases and other IT assets, including vulnerability scanning, validation, exploitation testing and technical assessment.
• Perform vulnerability analysis and security testing using appropriate security tools and techniques, identify exploitable vulnerabilities and assess their potential security and business impact.
• Execute security hardening and configuration reviews for Windows/Linux servers, network devices, security appliances and other infrastructure components based on security baselines and industry best practices.
• Work hands-on with IT Infrastructure and Application teams to remediate security findings, including configuration changes, patching, hardening and other technical corrective actions.
• Perform re-testing and technical validation after remediation to confirm that vulnerabilities have been effectively addressed and securely closed.
• Maintain vulnerability and penetration testing records, evidence and reports and provide technical input for risk acceptance, exception handling and audit/regulatory requirements.

• Experience in IT Security Governance, Cybersecurity, IT Risk Management, or related roles.
• Strong understanding of security frameworks such as ISO 27001, NIST, COBIT, or related standards.
• Experience with security policies, compliance, risk assessment, and audit processes.
• Experience in the banking, financial services, or regulated industries is highly preferred.