General Manager of Technology

About the role

General Manager Technology is responsible for the direction and architecture of Faspay's technology, payment products and applications, cloud platform and network, and project management. The role ensures systems are designed securely from the outset and built through official channels. This position does not run production, does not hold production credentials, and does not lead the security function. As the company has no Chief Technology Officer position, technology direction at management level rests with this role.

Key responsibilities

• Lead five units: TechDev (System Development), TechOps (SysOps), Project Management, Product Management, and Quality Assurance, including setting targets, development, and succession planning for Heads and Section Heads

• Establish technology strategy, roadmap, and architecture aligned with business objectives, and technical standards for technology functions

• Manage budget, technology vendors, and technical debt, including replacement of unsupported technology

• Report progress, risks, and compliance status to the CEO monthly, and to the Board of Directors and Board of Commissioners according to set schedules

• Lead weekly technology forum with GM Operation to align releases, risks, and priorities; record decisions and escalate unresolved differences to CEO

• Fill vacant positions under this role and ensure each critical system is supported by at least two people

• Set product direction, roadmap, and priorities with the business; establish secure development cycle with security requirements from design, threat modeling for fund flows, mandatory code review before release, and automated scanning of code, dependencies, and secrets

• Lead application vulnerability remediation program according to Board-approved remediation plan and IT Security-set deadlines

• Ensure application credentials and keys are managed through key management service (KMS) and not embedded in code or configuration

• Ensure developers have no direct write access to production; all changes submitted through official channels controlled by Production Operations under GM Operation

• Maintain inventory of applications, APIs, and third-party components with architecture and data flow documentation

• Ensure integrations with banks and partners meet applicable standards including SNAP, and card data and personal data are protected from design

• Ensure secure development training for all developers is conducted at least once per year

• Engineer cloud platform and network as code for all environments, and run dev cluster, database administration, and Application Support as second-line support

• Ensure sandbox environment is completely separate from production: separate cloud accounts and network with no path to production, test data only, and separate credentials

• Maintain network segmentation, card data environment isolation, and links to banks and partners; all changes through change board

• Design capacity, backup, and disaster recovery for platform, and conduct periodic recovery testing of critical systems with Production Operations

• Ensure TechOps staff work in production and sandbox only with Production Operations-approved access, issued by IT Security, and reviewed quarterly by IT GRC

• During Production Operations vacancy, TechOps continues running production and sandbox under applicable change control, and gradually hand over operations to Production Operations through handover runbooks with deadline set by CEO

• Implement security standards and policies set by IT Security on applications and platforms, and close findings according to deadlines

• Provide evidence and technical controls for PCI DSS 4.0.1, ISO/IEC 27001:2022, Bank Indonesia regulations (including PBI 2/2024 and PADG 24/2024), and Personal Data Protection Law compliance programs

• Support third-party audits and penetration tests, and execute root cause remediation for incidents involving applications and platform

• Approve emergency changes with Production Operations Section Head for changes requested by other functions; no GM approves their own emergency changes, and IT Security reviews all emergency changes afterwards

• Ensure every project and feature change passes security review and security checklist before development and before go-live

• Ensure merchant and partner onboarding process includes risk checks before service opens; merchant go-live approved by Production Operations Section Head on behalf of GM Operation, outside the onboarding channel

• Ensure Product Management, Project Management, and Service Onboarding have no production access and work only through back-office application

• Align release schedule with GM Operation including change windows and QA gates; sprint capacity agreed between Head of TechDev and Project Management Section Head, including security and technical work portion agreed with GM Operation and IT Security

• Manage project portfolio: priorities, capacity, and go/hold decisions recorded; security, compliance, and reliability work cannot be deferred without CEO approval

Job Qualification

• Bachelor's degree (S1) in information technology or related field

• Minimum 10 years experience, with at least 5 years leading software engineering and/or infrastructure platform, and experience leading an organization of at least 20 people

• Direct experience at payment service provider, bank, electronic money, or fintech regulated by Bank Indonesia and/or OJK

• Experience setting technology direction and architecture without technical superior, and accountable to the board

• Deep understanding of secure development practices (OWASP) and experience leading real-scale vulnerability remediation

• Experience building and operating cloud platform and network as code (infrastructure as code, CI/CD, containers), including disaster recovery

• Experience working in environment undergoing PCI DSS and ISO/IEC 27001, including third-party audits, with independent security function

• Sufficient product management and project governance understanding to direct both functions

• Ability to communicate technical risks to management clearly, including bad news

• Pass background check and provide conflict of interest statement per company policy

Preferred qualifications

• CISSP, CISM, CSSLP, CISA, or CCSP certification, or cloud architect certification

• Understanding of SNAP standards and banking API integration (host-to-host) in Indonesia

• Experience leading architecture and platform remediation post-incident

About us

Faspay is a licensed Payment Service Provider (PJP) supervised by Bank Indonesia, serving many merchants and connected with major banks in Indonesia. Every day we process and distribute funds belonging to others.