Cybersecurity Lead

Cybersecurity Lead(New role)
Positionging:
Provide local cybersecurity leadership focused on executing enterprise strategy, strengthening cybersecurity capability and maturity, driving proactive cyber hygiene, and improving cyber resilience and risk management outcomes. 

 
Scope:
Execute the enterprise cybersecurity strategy locally and develop the local cybersecurity roadmap and investment plan with the CIO. Oversee cyber hygiene, control remediation, risk documentation, resilience improvements, management reporting, and regulatory and audit support. Provide cybersecurity expertise and support to strengthen local risk assessment and business continuity capabilities. 

Tone:
Strategic, pragmatic and business-oriented, combining disciplined execution of the enterprise strategy with a forward-looking focus on opportunities to strengthen the local business’s cybersecurity capabilities and maturity. 

 

Role Summary:
Lead cybersecurity strategy and execution across the assigned market or business unit, translating enterprise and regional direction into local priorities while identifying opportunities to strengthen cybersecurity capability and maturity. Partner with the CIO to develop and deliver the local cybersecurity roadmap and investment plan, focusing resources on the most material risks and resilience needs. Provide cybersecurity leadership and influence to improve cyber hygiene, risk management, control performance and resilience across the business. 

Responsibilities:

• Strategy, roadmap and investment 

• Lead local cybersecurity and execute the enterprise strategy within the market or business unit. 

• Develop and deliver the local cybersecurity roadmap and investment plan with the CIO. 

• Translate enterprise and regional direction into practical priorities, delivery plans and measurable outcomes. 

• Prioritize investments and develop business cases aligned with material local risks, technology plans and enterprise standards. 

• Coordinate with regional and global cybersecurity, security operations, architecture and engineering teams to support consistent execution and escalation. 

• Assess local cybersecurity capabilities and maturity, identifying opportunities to strengthen resilience, control effectiveness and risk management practices. 

• Recommend strategic investments and capability improvements aligned with local business priorities, regulatory expectations and enterprise direction. 

• Cyber hygiene and control performance 

• Strengthen cyber hygiene across applications, infrastructure, endpoints, networks, cloud services and relevant third parties. 

• Use established KPIs and KRIs to monitor control health and drive action before non-compliance occurs. 

• Embed cybersecurity requirements early in technology projects, cloud adoption, digital transformation and material change. 

• Drive timely, sustainable remediation of control weaknesses, vulnerabilities, audit findings and regulatory observations. 

• Maintain evidence of control performance, remediation progress and management decisions for assurance, audit and regulatory review. 

• Risk and governance 

• Partner with local governance and control teams to identify, assess and communicate cybersecurity risks, ensuring clear treatment plans and management accountability. 

• Identify when technology change, control weaknesses, incidents or emerging threats require formal assessment and support its initiation. 

• Provide cybersecurity expertise, evidence and challenge to support formal risk assessments. 

• Support the treatment and tracking of risks, exceptions, acceptances and remediation commitments, escalating where needed. 

• Translate technical vulnerabilities and control weaknesses into clear business impacts and treatment decisions. 

• Support regulatory examinations, audit activities and remediation programs, ensuring timely and sustainable closure of findings. 

• Resilience and incident readiness 

• Improve cyber resilience through control hardening, incident readiness, recovery planning, dependency awareness, exercises and lessons learned. 

• Partner with business continuity owners to strengthen resilience where cybersecurity and business continuity dependencies intersect. 

• Leadership and stakeholder engagement 

• Act as a trusted cybersecurity advisor to business and technology leadership, providing guidance on cyber risk, resilience, investment priorities and strategic decision-making. 

• Build strong partnerships across business, technology, risk and control functions to strengthen cybersecurity ownership and accountability. 

• Deliver clear, decision-focused reporting and presentations to leadership and the Board on cyber risk, control health, remediation, resilience, investment priorities and roadmap delivery. 

• Influence business and technology leaders to strengthen ownership of cyber risks, controls and remediation commitments. 

Strategic Impact:
This role translates enterprise cybersecurity direction into effective local execution and measurable improvements in capability, maturity and control performance. By prioritizing investment, strengthening cyber hygiene and driving timely remediation, it reduces sustained risk exposure and supports informed, defensible decisions by management and local governance and control teams. It also improves cyber resilience and reinforces accountability across business and technology without duplicating enterprise strategy, formal risk assessment or business continuity ownership. 

Qualifications:

• 12+ years of progressive experience in cybersecurity, information security, technology risk or a related field, ideally in a complex or regulated environment. 

• Strong knowledge of enterprise cybersecurity frameworks, control environments, technology risk management and relevant regulatory expectations. 

• Experience translating enterprise cybersecurity strategy into practical local or regional roadmaps, investment priorities and business cases in partnership with CIO or technology leadership. 

• Proven ability to improve cyber hygiene, control performance and remediation across applications, infrastructure, cloud and technology operations. 

• Demonstrated ability to influence senior business and technology leaders and drive accountability for cybersecurity outcomes. 

• Ability to translate technical vulnerabilities and control weaknesses into clear business risks, treatment options and management decisions. 

• Experience supporting cyber resilience, incident readiness, technology recovery and lessons learned in partnership with business continuity owners. 

• Excellent stakeholder engagement, influencing and communication skills, with the ability to present complex cybersecurity matters clearly to senior leadership, the Board and other stakeholders. 

• A degree in information security, computer science, engineering or a related discipline is preferred. Relevant certifications, such as CISSP, CISM or CRISC, are advantageous. 

• Fluency in English and Japanese is required. 

Internal Guidelines about Work from Home:

Hybrid Model, following Manulife’s Working Better guidelines.

Over time:

0-40 hours/month.

Salary:

Based on our Work Rules, we will consider your experience, skills and knowledge when we decide the salary.

Commutation allowance and Variable Incentive Bonus are paid based on our Work Rules.

Working Hours:

Standard Working Hours: 9:00am - 5:00pm  (Include 1 hour break. Flex-time system available)

Benefits:

Social Insurance (Health Insurance, Employees' Pension, Unemployment Insurance, Worker's Accident Insurance), Benefit One, Training system (include Japanese lesson / English lesson), Childcare Leave/Family care Leave, Baby-sitter support program, wiwiw System (Support program for those who take Childcare Leave), Retirement Pension (only for Regular employee).

Holidays/Vacations:

Saturdays and Sundays

National Holidays

Year-end and new year holidays (December 30, December 31, January 2 and January 3)

Annual Paid Holiday

For Regular employee, other special holidays are available (e.g. Anniversary Leave, etc.)

Location:

Hatsudai Head Office, Tokyo Opera City, 3-20-2 Nishi Shinjuku, Shinjuku-ku, Tokyo Japan

When you join our team:

• We’ll empower you to learn and grow the career you want. 
• We’ll recognize and support you in a flexible environment where well-being and inclusion are more than just words. 
• As part of our global team, we’ll support you in shaping the future you want to see. 

About Manulife and John Hancock

Manulife Financial Corporation is a leading international financial services provider, helping people make their decisions easier and lives better. To learn more about us, visit https://www.manulife.com/en/about/our-story.html.

Manulife is an Equal Opportunity Employer

At Manulife/John Hancock, we embrace our diversity. We strive to attract, develop and retain a workforce that is as diverse as the customers we serve and to foster an inclusive work environment that embraces the strength of cultures and individuals. We are committed to fair recruitment, retention, advancement and compensation, and we administer all of our practices and programs without discrimination on the basis of race, ancestry, place of origin, colour, ethnic origin, citizenship, religion or religious beliefs, creed, sex (including pregnancy and pregnancy-related conditions), sexual orientation, genetic characteristics, veteran status, gender identity, gender expression, age, marital status, family status, disability, or any other ground protected by applicable law.

It is our priority to remove barriers to provide equal access to employment. A Human Resources representative will work with applicants who request a reasonable accommodation during the application process. All information shared during the accommodation request process will be stored and used in a manner that is consistent with applicable laws and Manulife/John Hancock policies. To request a reasonable accommodation in the application process, contact [email protected].

Hybrid