Mô tả công việc

Role Overview

Fundiin is evolving from a BNPL product into a multi-product consumer financial platform — and with that evolution comes increasing regulatory scrutiny, higher expectations from lenders and partners, and a growing attack surface that needs to be managed proactively.

As Information Security & Compliance Lead, you will play a pivotal role in shaping Fundiin's security function — building on existing practices and certifications to establish a comprehensive, proactive framework that scales with the business. You will own the security and compliance posture end-to-end, working closely with engineering, DevOps, and external vendors to ensure Fundiin can scale into regulated financial services with confidence.

Fundiin already holds ISO 27001 and PCI-DSS certifications and has established security practices in place — this role is not about starting from zero, but about bringing structure, ownership, and a proactive mindset to what exists, and building what is still missing.

For the right person, this is a rare opportunity to own and shape an entire security function at a high-growth fintech — with direct visibility to the CTO and meaningful impact on how Fundiin scales into regulated financial markets.

This is a role for someone who is technically grounded, ownership-oriented, and comfortable leading through influence rather than headcount.

What You Will Do

1. Vulnerability & Threat Management

• Own the vulnerability management program — define scope, tooling, SLAs, and remediation workflows; coordinate with DevOps and vendors for execution
• Monitor CVE feeds and vendor advisories; assess impact on Fundiin's tech stack and drive timely remediation
• Define security requirements and acceptance criteria for CI/CD pipeline — coordinate with DevOps to implement scanning and security gates

2. Security Operations & Access Control

• Define monitoring requirements and detection rules; coordinate with SOC vendor for 24/7 coverage; lead incident response when escalated
• Own the access control framework — enforce least privilege, conduct periodic access reviews, and ensure clean offboarding
• Define and enforce policies for developer access to production environments and sensitive data

3. Data Security & Privacy

• Own the data security framework — define classification, encryption, masking, and export control policies for customer PII and eKYC data
• Drive NĐ 13/2023 compliance — own data mapping, DPIA, and consent management; coordinate with product and engineering for implementation

4. Policy, Governance & Compliance

• Define and maintain security policies, rules, and checklists across the organization
• Own renewal and maintenance of ISO 27001 and PCI-DSS certifications; drive compliance with local regulatory requirements — coordinate with external auditors and consultants as needed
• Define and standardize compliance checklists for lender onboarding; coordinate responses to audit and security questionnaires from partners
• Maintain risk register and track remediation status; report regularly to management

5. Awareness & Reporting

• Define and drive the security awareness program — coordinate training and secure coding sessions for the engineering team
• Deliver regular risk, vulnerability, and remediation status reports to management
• Serve as primary point of contact for internal and external audits