Chief Information Security Officer
The Money Forward Group is expanding into the financial and banking sectors, including digital banking. Rigorous risk management and quality standards across the Group are a top management priority. Money Forward Vietnam (MFV) is the Group’s development hub, with approximately 470 employees across two offices in Ho Chi Minh City and Hanoi, working on more than 50 products across 21 divisions. The Group’s security assessments have reaffirmed that MFV’s local governance and execution capabilities are directly linked to trust, business continuity, and delivery across the Group. To date, a small local team has supported MFV’s security under the direction of the Group CISO Office in Japan. Going forward, MFV is expected not only to embed Group standards locally, but also to lead risk decisions that reflect Vietnam’s language, culture, and laws; respond swiftly to incidents on the ground; and implement financial-sector-level controls, including physical security. We are therefore establishing a dedicated security team at MFV and seeking an MFV CISO to lead it and take full responsibility for MFV’s security. As a member of the leadership team, you will help build the foundation for MFV’s evolution from a development hub into a Value Co-Creation Hub.
KEY RESPONSIBILITIES
As the leader responsible for information security at MFV, you will oversee everything from strategy, controls, and operations to incident response and team building. Security Strategy and Governance
* Develop MFV’s security strategy and medium-term roadmap, report to and build alignment with MFV leadership and the Group CISO.
* Drive the application and adoption of Group standards at MFV, including Group CISO Office policies, standards, and shared controls.
* Develop local policies and controls that address Vietnam-specific risks,
in alignment with the Group CISO Office.
* Agree on and operate roles and responsibilities (RACI), decision‑making authority, access to data and tools, and escalation paths with the Group CISO Office and Group Corporate IT.
* Develop approaches to compliance with Vietnam’s cybersecurity and personal data protection laws and regulations, in partnership with Legal.
* Conduct risk assessments, manage exceptions, and respond to audits and assessments.
* Advise business and internal initiatives on security and support responses to security requirements from Group companies and customers.
* Address security requirements, including physical security, arising from expansion into financial and banking businesses. Preventive Controls and Continuous Monitoring
* Design and operate MFV’s monitoring framework and SLAs for preventive controls such as EDR, DLP, access control, and device management.
* Define and visualize KPIs—including device compliance, violation counts, severity and recurrence, unresolved cases, false‑positive rates, and initial response times—and report regularly to leadership.
* Drive the security tooling roadmap agreed with the Group CISO Office.
* Lead MFV’s incident response from initial action through investigation, remediation, and prevention of recurrence, in coordination with Group CSIRT and the Group CISO Office.
* Build a team capable of responding quickly on the ground,
including interviewing those involved, securing devices, and preserving evidence.
* Escalate major incidents to leadership and the Group CISO, and coordinate responses that take local laws and employment practices into account, in partnership with Legal and HR. Security Culture and Education
* Design and operate a continuous learning cycle covering expectations set during hiring, onboarding, regular tests, sharing of case studies, refresher training, and in‑person workshops.
* Operate a Security Ambassador network made up of managers from each division, including hosting monthly meetings attended by leadership, and embed security practices across the organization.
* Promote a secure development culture in collaboration with each division and the Group CISO Office’s Product Security department. Team Building and Group Collaboration
* Recruit, develop, and evaluate Security Managers and Security Engineers, and strengthen the team’s capabilities.
* Develop budget and resource plans and design AI-enabled workflows, distinguishing work that can be delegated to AI from work that requires human judgment, on‑site response, and stakeholder alignment.
* Collaborate through regular meetings with the Group CISO and CISO Office (every two weeks) and Group Corporate IT (weekly).
* Share MFV’s security improvements across the Group as examples of good practice. Expected Outcomes (First-Year Milestones)
* First 3 months: Assess the current state of risks, controls, and organizational capabilities, and finalize an MFV security roadmap and roles and authority (RACI) agreed with the Group CISO Office.
* By 6 months: Begin operating MFV-side monitoring and SLAs for EDR, DLP, and access control, and establish regular KPI reporting.
* By 1 year: Maintain zero
KEY RESPONSIBILITIES
As the leader responsible for information security at MFV, you will oversee everything from strategy, controls, and operations to incident response and team building. Security Strategy and Governance
* Develop MFV’s security strategy and medium-term roadmap, report to and build alignment with MFV leadership and the Group CISO.
* Drive the application and adoption of Group standards at MFV, including Group CISO Office policies, standards, and shared controls.
* Develop local policies and controls that address Vietnam-specific risks,
in alignment with the Group CISO Office.
* Agree on and operate roles and responsibilities (RACI), decision‑making authority, access to data and tools, and escalation paths with the Group CISO Office and Group Corporate IT.
* Develop approaches to compliance with Vietnam’s cybersecurity and personal data protection laws and regulations, in partnership with Legal.
* Conduct risk assessments, manage exceptions, and respond to audits and assessments.
* Advise business and internal initiatives on security and support responses to security requirements from Group companies and customers.
* Address security requirements, including physical security, arising from expansion into financial and banking businesses. Preventive Controls and Continuous Monitoring
* Design and operate MFV’s monitoring framework and SLAs for preventive controls such as EDR, DLP, access control, and device management.
* Define and visualize KPIs—including device compliance, violation counts, severity and recurrence, unresolved cases, false‑positive rates, and initial response times—and report regularly to leadership.
* Drive the security tooling roadmap agreed with the Group CISO Office.
* Lead MFV’s incident response from initial action through investigation, remediation, and prevention of recurrence, in coordination with Group CSIRT and the Group CISO Office.
* Build a team capable of responding quickly on the ground,
including interviewing those involved, securing devices, and preserving evidence.
* Escalate major incidents to leadership and the Group CISO, and coordinate responses that take local laws and employment practices into account, in partnership with Legal and HR. Security Culture and Education
* Design and operate a continuous learning cycle covering expectations set during hiring, onboarding, regular tests, sharing of case studies, refresher training, and in‑person workshops.
* Operate a Security Ambassador network made up of managers from each division, including hosting monthly meetings attended by leadership, and embed security practices across the organization.
* Promote a secure development culture in collaboration with each division and the Group CISO Office’s Product Security department. Team Building and Group Collaboration
* Recruit, develop, and evaluate Security Managers and Security Engineers, and strengthen the team’s capabilities.
* Develop budget and resource plans and design AI-enabled workflows, distinguishing work that can be delegated to AI from work that requires human judgment, on‑site response, and stakeholder alignment.
* Collaborate through regular meetings with the Group CISO and CISO Office (every two weeks) and Group Corporate IT (weekly).
* Share MFV’s security improvements across the Group as examples of good practice. Expected Outcomes (First-Year Milestones)
* First 3 months: Assess the current state of risks, controls, and organizational capabilities, and finalize an MFV security roadmap and roles and authority (RACI) agreed with the Group CISO Office.
* By 6 months: Begin operating MFV-side monitoring and SLAs for EDR, DLP, and access control, and establish regular KPI reporting.
* By 1 year: Maintain zero