Head of Information Security

About Amartha

Amartha is a technology company focused on creating shared prosperity by developing digital financial solutions for the grassroots economy. Founded in 2010 as a microfinance institution, Amartha connects rural, women-led micro-enterprises with affordable capital. Amartha is expanding as a tech company, building a microfinance ecosystem that connects to the growing digital economy through capital, investment, and payment services. By boosting the competitiveness of micro and small entrepreneurs, Amartha empowers women-led MSMEs, creates jobs, and fosters inclusive economic growth.

Our Empowered to Grow culture guides how we work together. We Focus on Clarity, Take the Lead, and Grow Impact, empowering our people to take ownership and create meaningful, lasting impact.

About the Role

Amartha is an Indonesian fintech group that provides financial services to micro-entrepreneurs through several licensed entities in lending, payments, and related services. We are looking for a Head of Information Security to take the group's security posture to the next level.

You will set the security strategy for the whole group, lead the security team, and work with engineering, product, risk, legal, and the Board to protect our customers, their funds, and their data. The role combines program leadership, regulatory engagement, and enough technical depth to direct security engineering on cloud and Kubernetes platforms.

What You Will Do

• Set and run the group information security strategy, roadmap, and budget.
• Lead and grow the security team across GRC and data privacy, and security engineering, including hiring and developing team leads.
• Own security policies, standards, and the information security management system (ISO 27001) across all entities.
• Act as the main contact for regulators, auditors, and certification bodies on information security matters.
• Build identity, privileged access, and secret management controls for cloud and Kubernetes production environments.
• Lead detection and incident response, including the security operations (SOC) model, incident playbooks, and regulatory reporting.
• Design security controls for payment flows and partner integrations, together with engineering and finance.
• Run the application security program: security design review, penetration testing, vulnerability management, and bug bounty.
• Manage third-party and vendor security risk.
• Support data protection compliance under UU PDP, together with Legal.
• Build security awareness across the company, from field staff to leadership.
• Report security risk and program progress to the Chief Risk Officer, the executive team, and the Board risk committee.

What You Bring