Head of AI Security and Assurance

Head of AI Security and Assurance

The Company

Our client is seeking a Head of AI Security and Assurance to strengthen technology risk governance and independently assess the effectiveness of its cybersecurity controls across the group.

With operations spanning Singapore, Thailand, Indonesia, Malaysia and China, the group operates across a complex technology and regulatory landscape, including listed and regulated businesses, sensitive health data, and increasingly autonomous AI agents.

This is a pivotal role within the Office of the Head, Group IT, providing independent oversight of cybersecurity, third-party technology risks and AI assurance. The successful candidate will help establish a robust assurance framework, ensuring that security controls are effective, AI agents operate within approved boundaries, and technology risks are transparently reported to senior leadership and the Board Risk & Audit.

The Role

Reporting to the Director, Group IT, with a direct reporting line to Board Risk & Audit for risk findings, the Head of AI Security and Assurance will provide independent oversight of technology risks across the group. The role will cover:

• Cybersecurity Assurance: Develop and execute an annual programme to independently test cybersecurity controls across the group's regional operations, assess high-risk technology designs, review outsourced security monitoring, and track findings through to resolution or formal risk acceptance.
• Supplier & Third-Party Risk: Assess critical technology suppliers and outsourced providers before engagement and annually thereafter. Review security provisions in technology contracts, investigate supplier incidents, and maintain a group-wide technology risk register.
• AI Agent Assurance: Lead the approval process for AI agents before deployment, ensuring appropriate identity controls, permissions, operational boundaries and human oversight. Conduct ongoing reviews of live agents and oversee independent assurance mechanisms validated by external specialists.
• Risk Reporting & Regulatory Coordination: Report technology risks directly to the Director, Group IT, and Board Risk& Audit. Independently assess security incidents, coordinate with regulators and relevant listed or regulated entities, and recommend appropriate risk acceptance decisions.
• Security Awareness & Specialist Management: Define group-wide security awareness requirements, oversee training delivered by external vendors, and manage specialist resources engaged to conduct penetration testing, challenge AI security controls and investigate incidents.
• Regional Security Governance: Establish security contacts within each country IT team, monitor emerging cyberthreats—particularly those targeting AI agents—and translate them into practical assurance tests.
• The position is an independent assurance function and will not operate the security controls, monitoring desk or suppliers that it assesses.

The Requirements

• Minimum 10–15 years of experience in cybersecurity, technology risk or IT audit, including group-wide responsibilities across multiple countries.
• Proven track record of independently testing security controls and presenting findings to boards or audit committees.
• Working knowledge of AI agents, including their operational capabilities, potential failure points and security vulnerabilities. This is an essential requirement.
• Experience assessing technology suppliers, outsourced security providers and third-party risks.
• Knowledge of regional data protection and technology regulatory requirements, including Singapore's PDPA, China's PIPL, Singapore financial regulatory requirements and regulations applicable to listed companies in Indonesia.
• Experience working with regulators, internal audit teams and senior stakeholders on technology risk matters.
• Bachelor's degree in Computer Science, Information Security or a related discipline.
• Recognised security or audit certification such as CISSP, CISM or CISA, or equivalent professional qualifications. ISO 27001auditing qualifications and AI governance certifications such as IAPP AIGP would be advantageous.
• Excellent written and spoken English, with the ability to communicate complex technical risks clearly to board-level and non-technical audiences.
• Strong independence, professional judgement and the confidence to communicate difficult findings constructively.
• Willingness to travel across the group's regional operations.

The Next Step

Interested candidates may submit their resumes via this portal or email their CVs (in Wordformat) to [email protected].

EA Reg No.R1217793
EA License No. 23S1593