Manager, Cybersecurity & Risk

We are seeking a Manager, Cybersecurity and Risk to lead the University’s cybersecurity operations and governance, risk and compliance (GRC) functions. Reporting to the Director of Information Technology, this role will protect digital assets, strengthen cyber resilience and ensure alignment with relevant security standards and regulatory requirements. This is a fixed-term appointment based in Sarawak.

Responsibilities

1. Develop and implement the University’s cybersecurity strategy, policies and long-term security roadmap.

2. Oversee security operations, including threat monitoring, endpoint protection, data loss prevention and vulnerability management.

3. Lead responses to major cybersecurity incidents, including investigations, root cause analysis, corrective actions and regulatory reporting.

4. Conduct enterprise-wide IT risk assessments, maintain the corporate IT risk register and recommend mitigation measures.

5. Manage security governance and compliance with frameworks such as ISO 27001, NIST and COBIT, and coordinate internal and external audits.

6. Lead and develop the cybersecurity team, monitor performance and promote security awareness and data privacy across the University.

7. Manage cybersecurity budgets, resources, technology renewals and relationships with vendors and service providers.

8. Provide security advice for digital initiatives and prepare management and board-level reports on cybersecurity performance and risks.

Requirements

1. Bachelor’s degree in Computer Science, Information Technology, Cybersecurity or a related discipline. Higher qualifications may also be considered.

2. Minimum five (5) years of relevant experience, including at least two (2) years in a leadership or management role in cybersecurity operations, GRC or information security within a small to medium enterprise.

3. Strong knowledge of IT governance, regulatory requirements, risk management and cybersecurity best practices, with practical experience in ISO 27001, NIST and COBIT.

4. Proven experience leading enterprise-level IT risk assessments and maintaining a corporate risk register.

5. Extensive experience leading cybersecurity incident responses and conducting root cause analysis.

6. Hands-on experience with SIEM, next-generation firewalls, Endpoint Detection and Response (EDR), Data Loss Prevention (DLP) and vulnerability scanners.

7. Strong leadership, organisational and stakeholder management skills, including experience managing teams, vendors and contractors.

8. Ability to develop security policies, prepare board-level reports and present clear risk recommendations.

9. Highly desirable: At least two active, relevant IT certifications, including one at professional cybersecurity level, such as CISSP, CRISC, CISA or CISM.

10. Knowledge of local data protection laws, including PDPA, and experience in higher education are highly desirable.

11. Familiarity with infrastructure, cloud, networking and web security is preferred. Experience with IT Service Management (ITSM) tools is an advantage.

Required Skills

• Cybersecurity / InfoSec

benefits

• Health Insurance