Head of Information Security
Amartha · Jakarta
About Amartha
Amartha is a technology company focused on creating shared prosperity by developing digital financial solutions for the grassroots economy. Founded in 2010 as a microfinance institution, Amartha connects rural, women-led micro-enterprises with affordable capital. Amartha is expanding as a tech company, building a microfinance ecosystem that connects to the growing digital economy through capital, investment, and payment services. By boosting the competitiveness of micro and small entrepreneurs, Amartha empowers women-led MSMEs, creates jobs, and fosters inclusive economic growth.
Our Empowered to Grow culture guides how we work together. We Focus on Clarity, Take the Lead, and Grow Impact, empowering our people to take ownership and create meaningful, lasting impact.
About the Role
Amartha is an Indonesian fintech group that provides financial services to micro-entrepreneurs through several licensed entities in lending, payments, and related services. We are looking for a Head of Information Security to take the group's security posture to the next level.
You will set the security strategy for the whole group, lead the security team, and work with engineering, product, risk, legal, and the Board to protect our customers, their funds, and their data. The role combines program leadership, regulatory engagement, and enough technical depth to direct security engineering on cloud and Kubernetes platforms.
What You Will Do
- Set and run the group information security strategy, roadmap, and budget.
- Lead and grow the security team across GRC and data privacy, and security engineering, including hiring and developing team leads.
- Own security policies, standards, and the information security management system (ISO 27001) across all entities.
- Act as the main contact for regulators, auditors, and certification bodies on information security matters.
- Build identity, privileged access, and secret management controls for cloud and Kubernetes production environments.
- Lead detection and incident response, including the security operations (SOC) model, incident playbooks, and regulatory reporting.
- Design security controls for payment flows and partner integrations, together with engineering and finance.
- Run the application security program: security design review, penetration testing, vulnerability management, and bug bounty.
- Manage third-party and vendor security risk.
- Support data protection compliance under UU PDP, together with Legal.
- Build security awareness across the company, from field staff to leadership.
- Report security risk and program progress to the Chief Risk Officer, the executive team, and the Board risk committee.
What You Bring
- 10 or more years in information security, including at least 5 years leading a security function in a regulated financial institution, such as a bank, multifinance company, P2P lending platform, payment provider, or e-money issuer.
- Experience leading incident response and working directly with financial regulators.
- A track record of raising the maturity of a security program in a measurable way.
- Experience managing managers and leading a team of 15 or more across GRC and security engineering.
- Working knowledge of Indonesian regulations on information technology risk and data protection in financial services.
- Experience as the accountable owner of ISO 27001 certification and surveillance audits.
- Hands-on depth in cloud and Kubernetes security: RBAC, workload identity, admission control, runtime detection, and secret management.
- Experience with privileged access management, just-in-time access, and phishing-resistant MFA.
- Experience with SIEM and SOC operating models, both in-house and managed.
- Ability to explain security risk in business terms to executives and the Board.
- Fluent written and spoken Bahasa Indonesia and English, including formal correspondence with regulators.
Nice to have
- CISSP, CISM, or CISA. CCSP or another cloud security certification.
- Fintech competency certificate from an OJK-registered professional certification body (LSP) or from AFPI.
- Experience with multi-cloud environments and cloud migrations.
- Experience with fraud prevention and transaction monitoring controls.
- Experience securing AI agents and LLM-based tools.
At Amartha, we are dedicated to creating a workplace that celebrates diversity, ensures equity, and fosters inclusion. We believe that diverse perspectives—shaped by factors such as gender, age, race, ethnicity, education, culture, and life experiences—drive innovation and growth.
We actively welcome individuals from all backgrounds to join us in building an environment where everyone feels respected, valued, and empowered. Our commitment is to provide equal opportunities and foster a sense of belonging that enables our employees to thrive and make meaningful contributions.