Technology Talent Talk:

Foundational Technology Officers in Southeast Asia

3

New technologies are driving transformation in every industry, and Southeast Asian companies must react with urgency.

In this three-part series on technology talent, Russell Reynolds Associates takes a deeper look at the executive ranks of the region’s top companies to gauge commitment to this movement.

It’s increasingly clear that technology is – or should be – at the heart of every modern business model. To better understand how this trend is playing out in Southeast Asia, we examined the top ten listed companies by market capitalization for Singapore, Malaysia, Indonesia, Thailand and Vietnam – the five countries that account for about three-quarters of Southeast Asia’s GDP. 1

As an indicator of corporate commitment to various technology efforts, we charted the prevalence of three types of senior technology roles as well as associated career paths:

1. Foundational Technology Officers: Chief Information Officer (CIO) and Chief Information Security Officer (CISO)

2. Enabling Technology Officers: Chief Technology Officer (CTO) and Chief Digital Officer (CDO)

3. Disruptive Technologies Officers: Titles vary; key mandates include AI, IoT, and big data

Here, we look specifically at the prevalence and career paths of leaders in the first category, the CIO and CISO.

4

PERCENTAGE OF ORGANIZATIONS WITH A CIO

Singapore

70%

Talent InsightsCIOs and CISOs are responsible for developing and implementing the foundational technology layer that forms the bedrock for more advanced technologies.

The CIO is generally an internally-focused executive who is charged with managing the IT infrastructure. CIOs keep IT strategy, operational efficiency and performance reliability in mind to ensure uptime of the mission-critical IT systems that support company operations. The role is in the midst of transformation with the advent of cloud, platforms and software as a service (PaaS/SaaS).

In addition to CIOs, many global companies are also hiring CISOs as information security increasingly becomes top of mind due to regulatory requirements and heightened threats. A CISO’s responsibilities include IT security, but also cover data privacy and compliance. A primary goal for this role is to mitigate the risks associated with insecure information, including financial, legal and reputational costs.

Our research finds that companies in Southeast Asia are more likely to have a CIO than a CISO, in keeping with global trends -- yet overall, they are less likely to have either role compared with companies in other geographies.

Across the region, 54 percent of companies have a CIO, compared to a 96 percent global average. This relatively low average is in part due to a high degree of disparity across countries. Companies in Malaysia, Indonesia and Singapore are more likely to have such talent in place, while companies in Vietnam and Thailand are still playing catch-up. When companies lack a dedicated CIO, the IT function is often integrated with a non-technology function and led by a Technology & Operations Officer.

Malaysia

80%

Indonesia

70%

Thailand

40%

Vietnam

10%

SEAAverage

54%

Global Average

96%

5

PERCENTAGE OF ORGANIZATIONS WITH A CISO

Singapore

20%

On the information security front, nearly all Southeast Asian companies have a long way to go, as few have made significant investments in this domain. There is scant difference in the prevalence of CISOs in the region, and the 10 percent average for Southeast Asia stands in stark contrast to the global average of 49 percent.

Taking an industry view, telecommunications and financial services companies have the highest proportion of CIOs and CISOs, at 80 percent and 67 percent respectively, due to their heavier compliance requirements, followed by consumer products companies, which have been disrupted by digital and e-commerce.

Telecommunications & Financial Services

have the highest proportion of CIOs & CISOs.

Malaysia

10%

Indonesia

10%

Thailand

0%Vietnam

10%

SEAAverage

10%

Global Average

49%

6

CIO and CISO Career PathsSoutheast Asia’s CIOs and CISOs tend to have deep experience, though often eclectic career paths.

The average CIO has been in his or her current role for an average of 4.9 years, with 27.1 years of total career experience.

Sixty-two percent have been in the IT function throughout their career, with many having previously worked for established IT consultancies that exposed them to best practices across industries. Nearly a quarter – 23 percent – have a non-technology background (typically in general management), while the remaining 15 percent possess more digital experience akin to that of a Chief Digital Officer.

Overall, CISOs have an average of 5.6 years of experience in their current role and 29.4 years of career experience. However, none of them started out focusing on information security; 40 percent had CIO career tracks and 60 percent were in non-technology careers.

The path from CIO to CISO is logical in light of the fact that many CIOs in Southeast Asia have an auxiliary mandate to develop cybersecurity for the organization. Yet, our experience indicates that the ideal CISO is solely focused on security and reports directly to the CEO, so that the individual is strategically positioned and has a compelling independent voice in executive discussions.2

Total Career: 29.4 years

Current Role: 5.6 years

Current Role: 4.9 yearsTotal Career: 27.1 years

CHIEF INFORMATION OFFICER

CHIEF INFORMATION SECURITY OFFICER

7

Building a best-in-class technology function requires a patient and long term-oriented view towards implementing IT solutions and changing organizational culture. One way to enable success is to promote longer tenures among CIOs. Currently, the average CIO tenure in Southeast Asia is slightly below the 5-year global average noted in a recent EY report on CIOs, and shorter than the recommended 7 years.3

These relatively short tenures are due to two factors. Some companies are in the early days of building up their technology function and need to retain current leaders to mature it, instead of swapping leaders frequently. Others are more advanced, but face high turnover rates.

In either case, CEOs will have to consider how they create more conducive environments for long-term IT stewardship. CEOs will have to consider the autonomy, resources and opportunities provided to CIOs, and likely offer them a bigger voice in executive decisions.

Looking Ahead

1 JP Morgan. “ASEAN’s bright future: Growth opportunities for corporates in the ASEAN region.” https://www.jpmorgan.com/country/US/EN/cib/invest-ment-banking/trade-asean-future2 Russell Reynolds Associates. “Inside the Mind of the CTO”. http://www.russellreynolds.com/insights/thought-leadership/inside-the-mind-of-the-cto3 EY. “The DNA of the CIO.” https://www.ey.com/gl/en/services/advisory/the-dna-of-the-cio

On the CISO front, the time is ripe for Southeast Asian companies to think more carefully about hiring an executive dedicated to the security function. Many companies have made significant investments into their fundamental IT infrastructure. As IT, digital and data infrastructure grows in scale and complexity alongside increased compliance and privacy requirements, top-notch information security technology and talent will become baseline requirements as well.

Across both CIOs and CISOs, as companies become more attuned to new technologies such as e-commerce, the demand for suitable individuals – or those with the potential to step up – will inevitably increase. Retaining existing talent will be as important as recruiting new ones. Looking ahead, it is worthwhile for companies to put well-structured retention plans in place now, before the competition for talent intensifies.

NICK CHIA is a member of the firm’s Technology, Industrial, Energy & Natural Resources sectors, where he works as a trusted advisor to both international and regional clients. He is based in Singapore.

ZHENG WEI LIM is a member of the firm’s Global Knowledge team for the Technology sector, providing insights and data-driven analyses on key challenges in Technology. He is based in Singapore.

Authors

Russell Reynolds Associates is a global search and leadership advisory firm. Our 425+ consultants in 46 offices work with public, private and nonprofit organizations across all industries and regions. We help our clients build teams of transformational leaders who can meet today’s challenges and anticipate the digital, economic and political trends that are reshaping the global business environment. From helping boards with their structure, culture and effectiveness to identifying, assessing and defining the best leadership for organizations, our teams bring their decades of expertise to help clients solve their most complex leadership issues. Find out more at www.russellreynolds.com. Follow us on Twitter: @RRAonLeadership

RussellReynolds.com