Sedha Consulting Hiring! Full Time Senior Information Technology Security Officer in - Ricebowl

What the Role is

As part of the IT Information Security function, the IT Security Officer (ITSO) will play a senior, hands‑on role in shaping, embedding and uplifting the cybersecurity posture of a national digital platform. Beyond day‑to‑day security operations, the role is expected to drive security architecture, influence product and engineering decisions, and elevate cybersecurity practices across the platform and its delivery partners.

Key Focus Areas

1. Security Architecture & Secure‑by‑Design Practices

• Lead and contribute to security architecture reviews, threat modelling and design risk assessments for systems, integrations and cloud architectures
• Ensure security requirements are embedded early in the SDLC, working closely with product owners, engineers and vendors
• Translate VAPT findings and emerging threats into prioritised, risk‑based remediation and architectural improvements

2. Cybersecurity Operations & Incident Ownership

• Own and oversee end‑to‑end cyber and data incident response, including detection, containment, root‑cause analysis and long‑term preventive controls
• Guide the continuous improvement of SOC monitoring, SIEM use‑cases, playbooks and response maturity
• Assess effectiveness of implemented controls and track cybersecurity risk reduction outcomes

3. Cloud, Platform & DevSecOps Security

• Lead the implementation and optimisation of cloud security controls across AWS and Azure environments
• Work with engineering teams to embed DevSecOps practices (SAST, DAST, dependency and container scanning) into GitLab CI/CD pipelines
• Review platform architecture for resilience, privilege management, secrets management and secure data flows

4. Governance, Risk & Compliance

• Serve as ITSO accountable for compliance with IM8, PDPA, ISO 27001 and Government cybersecurity requirements
• Lead IT audit engagements, security reviews and regulatory assessments, providing clear, defensible documentation and remediation plans
• Maintain and evolve security policies, standards, procedures and playbooks to reflect platform realities and emerging threats

5. Practice Uplift, Influence & Mentorship

• Act as a trusted cybersecurity advisor to product teams, management and vendors
• Mentor junior security staff and guide vendors / contractors to achieve required security outcomes
• Proactively identify opportunities to uplift cybersecurity maturity, tooling effectiveness and ways of working

What We Are Looking For:

Experience & Technical Capabilities

• Bachelor’s degree in Computer Science, Information Security or related discipline
• Minimum 5 years of hands‑on cybersecurity experience, with demonstrable ownership of complex security initiatives

Strong experience across:

• Endpoint & Threat Detection (EDR / XDR / Threat Hunting)
• Application, Infrastructure & Data Protection (WAF, ASM, DLP)
• Cloud Security (AWS & Azure native security services)
• Security Operations & Monitoring (SIEM)
• Vulnerability Management & Security Testing (VAPT, SCR, Bug Bounty)
• Identity & Access Management (IAM, privileged access concepts)
• Practical experience integrating security into modern DevSecOps environments
• Proven ability to translate technical risks into business‑relevant recommendations

Professional Attributes

• Comfortable operating in ambiguously‑scoped environments, taking ownership end‑to‑end
• Strong communication and stakeholder management skills
• Demonstrated ability to influence without authority across teams and vendors
• Analytical, risk‑based mindset with attention to audit defensibility
• Ability to leverage automation and generative AI tools responsibly to enhance security effectiveness

Preferred Qualifications

• Industry certifications such as CISSP, CISM, CISA, CCSP, CEH or GIAC
• Experience in government, critical systems or highly regulated environments
• Exposure to platform‑scale or national‑level digital systems