Principal / Senior Information Security Consultant (Risk, Architecture and Production Security)

About the role

Sony is looking for a Principal / Senior Information Security Consultant to provide regional subject-matter leadership and trusted advisory services across risk management, security architecture and production security. The role supports Asia Pacific operating companies in identifying, assessing and managing information security risks, implementing effective controls and making informed risk decisions that protect Sony information assets and support resilient business operations. It covers business applications and infrastructure, manufacturing and operational technology environments, critical information assets and third-party suppliers and services.

Key responsibilities

• Plan and execute regional business-as-usual security services and initiatives according to approved priorities, service standards and KPIs.
• Lead business, technical and third-party security assessments, evaluate threats, vulnerabilities and control effectiveness, document findings and recommend treatment options.
• Review new projects, technology designs, infrastructure and manufacturing environments so security requirements are met and practical mitigations are defined.
• Advise operating companies on Sony information security policies, standards and control requirements, identify implementation gaps and support risk acceptance or policy-exception processes.
• Take end-to-end ownership of regional or global initiatives, coordinate cross-functional contributors and improve methods and templates.
• Translate technical findings into business risk implications for management, Information Systems, Legal, Privacy, HR, Finance, Procurement and others.
• Build partnerships with regional ISO teams, CISD, global security functions, operating-company security managers and business owners.

Required profile

• Bachelor's degree in Information Security, Computer Science, Information Systems, Engineering or a related discipline, or equivalent professional experience.
• At least 8 years of progressive information security experience, including substantial hands-on work in risk management, security architecture, production or OT security, governance or assurance.
• Expertise in at least three areas such as enterprise risk, cloud security, network security, application security, IAM, vulnerability management, manufacturing or OT security, or supplier security.
• Proven ability to lead cross-functional initiatives in a geographically distributed, multicultural environment.
• Excellent written and spoken English; additional regional language is advantageous.

Required skills

• Risk assessment and treatment, security-control evaluation, governance and compliance frameworks, third-party risk management and remediation planning.
• Working knowledge of GRC platforms, reporting and analytical tools, and standard productivity applications.
• Preferred: AI tool expertise, CISSP, CISM, CRISC, CCSP, ISO/IEC 27001 or equivalent certification.

What we offer

• Flexible work arrangement.
• Medical benefits including physical health screenings and term life insurance.
• AWS and variable bonus, special staff purchase rates and flexible benefits.
• One day of corporate social responsibility time off per year to volunteer, milestone gifts, wellness activities and curated training programmes.