Japan Cyber Security Lead

Cybersecurity Lead(New role)

Positionging: Provide local cybersecurity leadership focused on executing enterprise strategy, strengthening cybersecurity capability and maturity, driving proactive cyber hygiene, and improving cyber resilience and risk management outcomes.

Scope:

Execute the enterprise cybersecurity strategy locally and develop the local cybersecurity roadmap and investment plan with the CIO. Oversee cyber hygiene, control remediation, risk documentation, resilience improvements, management reporting, and regulatory and audit support. Provide cybersecurity expertise and support to strengthen local risk assessment and business continuity capabilities.

Tone:

Strategic, pragmatic and business-oriented, combining disciplined execution of the enterprise strategy with a forward-looking focus on opportunities to strengthen the local business’s cybersecurity capabilities and maturity.

Role Summary:

Lead cybersecurity strategy and execution across the assigned market or business unit, translating enterprise and regional direction into local priorities while identifying opportunities to strengthen cybersecurity capability and maturity. Partner with the CIO to develop and deliver the local cybersecurity roadmap and investment plan, focusing resources on the most material risks and resilience needs. Provide cybersecurity leadership and influence to improve cyber hygiene, risk management, control performance and resilience across the business.

Responsibilities:

• Strategy, roadmap and investment

• Lead local cybersecurity and execute the enterprise strategy within the market or business unit.

• Develop and deliver the local cybersecurity roadmap and investment plan with the CIO.

• Translate enterprise and regional direction into practical priorities, delivery plans and measurable outcomes.

• Prioritize investments and develop business cases aligned with material local risks, technology plans and enterprise standards.

• Coordinate with regional and global cybersecurity, security operations, architecture and engineering teams to support consistent execution and escalation.

• Assess local cybersecurity capabilities and maturity, identifying opportunities to strengthen resilience, control effectiveness and risk management practices.

• Recommend strategic investments and capability improvements aligned with local business priorities, regulatory expectations and enterprise direction.

• Cyber hygiene and control performance

• Strengthen cyber hygiene across applications, infrastructure, endpoints, networks, cloud services and relevant third parties.

• Use established KPIs and KRIs to monitor control health and drive action before non-compliance occurs.

• Embed cybersecurity requirements early in technology projects, cloud adoption, digital transformation and material change.

• Drive timely, sustainable remediation of control weaknesses, vulnerabilities, audit findings and regulatory observations.

• Maintain evidence of control performance, remediation progress and management decisions for assurance, audit and regulatory review.

• Risk and governance

• Partner with local governance and control teams to identify, assess and communicate cybersecurity risks, ensuring clear treatment plans and management accountability.

• Identify when technology change, control weaknesses, incidents or emerging threats require formal assessment and support its initiation.

• Provide cybersecurity expertise, evidence and challenge to support formal risk assessments.

• Support the treatment and tracking of risks, exceptions, acceptances and remediation commitments, escalating where needed.

• Translate technical vulnerabilities and control weaknesses into clear business impacts and treatment decisions.

• Support regulatory examinations, audit activities and remediation programs, ensuring timely and sustainable closure of findings.

• Resilience and incident readiness

• Improve cyber resilience through control hardening, incident readiness, recovery planning, dependency awareness, exercises and lessons learned.

• Partner with business continuity owners to strengthen resilience where cybersecurity and business continuity dependencies intersect.

• Leadership and stakeholder engagement

• Act as a trusted cybersecurity advisor to business and technology leadership, providing guidance on cyber risk, resilience, investment priorities and strategic decision-making.

• Build strong partnerships across business, technology, risk and control functions to strengthen cybersecurity ownership and accountability.

• Deliver clear, decision-focused reporting and presentations to leadership and the Board on cyber risk, control health, remediation, resilience, investment priorities and roadmap delivery.

• Influence business and technology leaders to strengthen ownership of cyber risks, controls and remediation commitments.

Strategic Impact:

This role translates enterprise cybersecurity direction into effective local…