About This Role
This leadership role focuses on building and leading the global security and compliance function across a complex, multi-cloud, multi-jurisdiction environment. The Security Manager will operate at both strategic and technical depth, architecting secure-by-design products, running a mature Product Security program, and ensuring compliance with evolving national data protection and cybersecurity laws. This person will own the end-to-end security posture of products and platforms, lead multi-disciplinary security teams, and act as the primary bridge between engineering, compliance, and executive leadership on security risk.
Responsibilities
- Build, own, and continuously mature the end-to-end Product Security and Compliance program across all company products and markets
- Lead and manage multi-disciplinary security teams spanning Application Security, Security Architecture, Penetration Testing, DevSecOps, and Cloud Security Operations
- Define and report Security & Compliance KPIs and risk metrics to executive stakeholders and the board
- Translate technical security and regulatory risk into business impact and actionable decisions for leadership
- Define, implement, and enforce a Secure SDLC, embedding security from design through production across all engineering teams
- Drive security architecture reviews and threat modeling for new and existing products
- Ensure secure usage of cloud-native services, APIs, and third-party dependencies across the product portfolio
- Own product vulnerability management end-to-end: discovery, triage, risk-based prioritization, remediation tracking, and verification
- Define and oversee the offensive security strategy — pentesting scope, cadence, vendor management, and remediation follow-up
- Set and enforce unified security architecture standards across a heterogeneous multi-cloud environment (AWS, GCP, Azure, Huawei Cloud, Yandex Cloud, on-premises)
- Own identity and access architecture, including enterprise SSO, short-lived session tokens, and least-privilege access mapping across all cloud providers
- Oversee Cloud-Native Application Protection Platform (CNAPP) coverage and automated misconfiguration containment across all environments
- Ensure cryptographic key management practices (BYOK/CMEK, HSMs, vendor-agnostic key custody) meet data sovereignty requirements in each market
- Own and continuously maintain the company’s compliance map across all operating jurisdictions, including Vietnam (Decree 13/2023/ND-CP – PDPD), Indonesia (Law No. 27/2022 – UU PDP), the Philippines (RA 10173 – DPA), Kazakhstan (Law No. 94-V), Laos and Cambodia (cybersecurity/e-commerce regulations), and the EU (GDPR and the Danish Data Protection Act for Denmark operations)
- Translate country-specific data localization, sovereignty, and breach-notification requirements into concrete technical and process controls
