A Head of Security Posting Is Not a Hire. It Is a Gap.

Open a job board in Vietnam this week and count. One page of ITviec listings showed twenty cybersecurity roles, twenty platform and DevOps roles, twenty AI engineering roles, and seven dedicated fintech positions. Several had been posted in the previous eighteen hours. A head of information security at a securities firm. A CISO at a payments company. Application security engineers, compliance officers, network specialists at two banks.

Talent demand is the usual reading, and it is true. But there is a second reading that matters more for anyone who buys software: a senior security posting is a public statement that work exists and nobody owns it yet.

What a vacancy actually costs

A head of information security is not one seat in a room. The role owns a programme: which systems get reviewed, what happens when a vendor ships a new integration, who answers the regulator, how an incident gets escalated at 02:00, and whether the payment flow that went live last month was ever threat-modelled.

When that seat is empty, the work does not pause. It queues.

The queue is not theoretical. Over the past two weeks this publication covered a French bank losing roughly 100 million euros through its own authorised payment rails, and a Binance incident that began with a fake job interview and a poisoned developer package. Neither was a firewall failure. Both were failures of a process that a security programme is supposed to own — authorising an instruction, and vetting what developers install.

A company hiring a CISO is not necessarily in trouble. A company hiring a CISO and an application-security engineer and a compliance officer in the same month is telling you its programme is being built from scratch, fast.

Why hiring alone does not close it

Three things make the hire-only path slower than it looks.

Senior security hires take months. A head of information security or a CISO is a six-figure decision with a shortlist of perhaps twenty credible candidates in the country. From posting to productive is measured in quarters, not weeks.

The first ninety days are discovery. A new security lead spends the first stretch mapping systems, finding owners and reading contracts. That is necessary work, and it is also the period in which nothing gets fixed.

One person is not a programme. Even a strong hire inherits a backlog: unpatched services, undocumented integrations, vendor access nobody reviewed, and a secure-development process that exists in a slide deck. Closing that backlog is delivery work, not leadership work — and it needs more hands than the role provides.

The mistake buyers make

The instinct is to treat this as a staffing problem: we need a security person, so we hire one. The result is a senior person spending their first year as a very expensive project manager for work that never gets resourced.

The alternative is to separate two questions that get bundled together:

Who owns the security programme? That is a hire. It should be a hire.
Who does the backlog of work the programme will direct? That is capacity, and it does not have to arrive in the same shape.

Answering only the first question is how companies end up with a CISO and no progress. Answering only the second is how they end up with a vendor doing work nobody owns.

Where ABN Asia fits

ABN Asia builds and secures software across three areas: AI systems, banking and payments engineering, and network and application security. Most of our work sits exactly in the gap described above — the period between "we know this needs fixing" and "the person who owns it has started."

In practice that means two ways to work with us.

Alongside the hire. A fixed-scope security review or a delivery squad runs now, produces the artefacts a new security lead would otherwise spend a quarter assembling — architecture map, threat model, prioritised findings, a secure-development checklist — and hands over when the seat is filled. The hire arrives with a programme already drafted instead of a blank page.

Instead of the hire, for the delivery portion. Where the role is genuinely hard to fill, an embedded team covers the engineering: hardening the payment path, reviewing third-party integrations, building the review process into the pipeline so it stops being a quarterly event.

We are deliberately not claiming that a vendor replaces a security leader. It does not. Someone inside the company has to own the risk, sign the exceptions and face the regulator. What we remove is the excuse that nothing can happen until that person starts.

What happens next

If your team has a security or payments role open, the honest question is not whether to hire — it is what runs in the meantime. ABN starts with a written brief, then a thirty-minute call, then a fixed-scope proposal with a written estimate in three business days. No price is quoted before the scope is real.

The postings are public. The gap they describe is not a secret, and it is not a criticism of the companies hiring. It is simply where the work is.

Sources: ITviec public job listings, snapshot 7 November 2026 (20 cybersecurity, 20 platform/DevOps, 20 AI and 7 fintech roles on a single page); this publication's reporting on the Crédit Mutuel Arkéa incident (5 November 2026) and the Binance incident report.