Head of Security & Compliance

Independent verification is credible only when the verifier can withstand scrutiny itself. You will be Lawnise's senior security and compliance authority: advising leadership, challenging material decisions and setting a proportionate direction for security, privacy and enterprise assurance.

You will help Lawnise earn trust in senior customer and industry conversations, without turning the role into ceremonial oversight. Engineering, operations and counsel will execute within their disciplines; you will make sure priorities, risk decisions, evidence and accountability remain coherent.

Lawnise is moving into deeper enterprise engagements with regulated organisations. Customers and partners need to see credible senior judgement behind our control position, customer commitments and security boundaries. This role gives leadership an experienced challenger and gives the market a trusted counterpart who can represent Lawnise with substance.

• Advise the CEO and engineering leadership on security, privacy, technology-risk and enterprise-assurance priorities.
• Set and periodically challenge Lawnise's control roadmap, risk posture and path toward independent assurance or certification.
• Review material risk acceptances, security positions and customer commitments within documented authority; binding commitments remain with authorised executives and counsel.
• Guide customer security, privacy and technology-risk assessments, joining the consequential review conversations rather than acting as a questionnaire administrator.
• Oversee the quality of Lawnise's assurance evidence, incident readiness and executive review cadence, with operational controls owned by the teams that run them.
• Provide senior governance for ThreatGuard authorisation, rules of engagement and safety boundaries before security assessments are undertaken.
• Represent Lawnise credibly with CISOs, risk leaders, regulated buyers and relevant professional forums.
• Develop trusted relationships across financial services, cybersecurity, governance, legal and assurance communities, and make relevant introductions where appropriate.

• Significant responsibility in information security, technology risk, audit or third-party risk in—or supplying—regulated financial institutions.
• First-hand experience leading or assessing enterprise security questionnaires and the review conversations behind them.
• Working knowledge of Malaysian financial-sector technology-risk expectations and data-protection obligations, with the judgement to know when specialist legal interpretation is needed.
• Experience translating policy and contractual commitments into operating controls and evidence.
• Participation in incident response, notification or exercises with accountable follow-through.
• Enough technical depth to examine cloud, identity, secrets, network and database-access controls with engineers.
• Clear written communication and the composure to represent a control position under scrutiny.
• Established relationships across regulated financial services, cybersecurity, technology risk or assurance, with the judgement to make relevant introductions without implying influence or guaranteed access.

Experience with ISO 27001, SOC 2, CISSP, CISM or CRISC may be useful, but certification is not a substitute for operating judgement. Experience on both sides of regulated-enterprise vendor assessment is particularly relevant. Bahasa Malaysia is useful for the launch market.

We are open to a full-time or fractional arrangement, depending on the candidate, availability and the operating model agreed together. In either form, this is a substantive leadership mandate with documented access, responsibility and direct engagement with executive and engineering owners.

Work that requires legal opinion or binds the company remains with external counsel and authorised executive signatories.

The final arrangement, responsibilities and decision authority will be confirmed in writing before the engagement begins.