Head of Cybersecurity

At Orient Path, we are looking for a Head of Cybersecurity for a global EdTech Platform to expand and lead the security function across application security, security compliance, infrastructure and cloud security, and business application security. Reporting to the CTO, this leader will take over a small existing security team and grow it as the company scales.

This is a hands-on leadership role that combines setting direction and representing security to leadership with deep technical collaboration across Engineering, DevOps, IT, compliance, and business application teams.

Location: Singapore / Hybrid (2 days per week in office)

Scope

• Lead the cybersecurity function across application security, security compliance, infrastructure and cloud security, and business application security.
• Set security direction, represent security to company leadership, and prioritize across competing demands.
• Lead and grow a small existing security team as the company scales.
• Partner with Engineering, DevOps, IT, compliance, and business application teams to embed practical, scalable security controls.

What You’ll Do

• Build the AppSec Program: Establish and run application security, including agentic and AI-assisted reviews of code and pull requests.
• Embed Security in Delivery: Integrate security checks into CI/CD pipelines so vulnerabilities are identified before production.
• Strengthen Secure Development: Deliver developer security training, champion secure coding practices, and evaluate AI coding tools for secure adoption.
• Lead Security Compliance: Own ISO 27001 and SOC 2 certification, ongoing audits, and the roadmap for additional certifications required by the business.
• Scale Controls and Evidence: Maintain policies, controls, and audit evidence in a way that supports growth without slowing teams down.
• Secure Cloud Infrastructure: Work with DevOps to secure Kubernetes infrastructure and cloud environments, including sovereign cloud deployments.
• Define Infrastructure Standards: Set security standards for infrastructure as code, network architecture, access control, and secure-by-default configurations.
• Protect Business Applications: Partner with IT and business application teams to secure Microsoft 365 and other line-of-business systems, including CRM and ERP.
• Own Identity and Data Controls: Manage identity, access, and data protection controls across business applications.
• Manage Third-Party Risk: Oversee vendor risk for business-critical SaaS providers.

What You Bring

• 8+ years of experience in information security, including 3+ years in a leadership role, preferably within all-remote or hybrid international organizations.
• Track record of running application security programs, ideally using CI/CD-integrated tooling and modern AI-assisted code review.
• Hands-on experience with ISO 27001 and/or SOC 2, including proven responsibility for leading and successfully completing an audit.
• Experience securing business applications such as Microsoft 365, CRM, and ERP, together with vendor risk management.
• Working knowledge of Kubernetes and cloud security.
• Ability to explain risks and trade-offs clearly to both engineers and executives.
• Comfort operating with a small team and prioritizing across competing demands.

Nice to Have

• Experience securing sovereign cloud environments.

Working Arrangement

• Based in Singapore, with a hybrid schedule of two days per week in the office.
• Occasional international travel may be required.