Serena Rahman · Chief Information Officer · Singapore / Southeast Asia
| Capacity | Committees |
|---|---|
| Ready to chair | A board risk committee or technology committee, after a year as a member |
| Ready to join | Board Risk Committee · Technology or cyber risk committee · Audit Committee, as a member contributing technology-control experience rather than accounting expertise |
I am pursuing one independent directorship at an SGX-listed company, or at a larger private group preparing to list, with operations across several Southeast Asian countries and revenue of perhaps S$300 million to S$2 billion. The companies I can help most hold large amounts of other people's personal data, depend on outsourced or offshore operations, or are growing by acquisition: healthcare and diagnostics groups, logistics and business-services companies with large outsourced workforces, education providers, and non-bank financial companies such as insurance brokers and payment businesses.
I want to join a board risk committee or a technology committee, and to chair one after a year if the board wishes. I would also be a useful member of an Audit Committee, provided the board has the accounting expertise the Singapore Code expects elsewhere. I am not looking for a seat that needs a name on a list, or for a board that treats technology risk as a single agenda item each year. I would take one seat only while I remain an executive. SGX rules and the Code leave each board to judge how many directorships a director can manage, and my answer, with a full-time role, is one.
Presented to the Board or a committee
Board of directors: technology and cyber risk, acquisition diligence, hosting and major incidents
April 2022–present
Presents a technology and cyber risk paper at every quarterly board meeting and the IT section of every acquisition paper; not a director of the company.
Reported to a committee
Audit and Risk Committee: access controls, insider risk, disaster-recovery testing and personal-data incidents
January 2021–present
Reports quarterly, including every failed recovery test and every incident involving client personal data; not a committee member.
Served as a director
Board of the wholly owned Thai subsidiary
July 2024–present
Director in an executive capacity, overseeing the remediation milestones and approving the subsidiary's technology and data-protection policies.
Served as a director
Board of a Singapore charity; chair of its IT and data protection subcommittee
March 2021–present
Non-executive board member of a charity that teaches digital skills to older workers; chairs the subcommittee that oversees its systems and learners' personal data.
Presented to the Board or a committee
Board of directors: security incidents and certification
2013–2016
Presented twice a year on physical and logical security, certification progress and incidents affecting customers.
IICA Independent Directors’ Databank: Not yet registered
India keeps a databank of independent directors under its Companies Act, and registration applies to people taking independent seats at Indian companies. I am seeking a seat in Singapore or elsewhere in Southeast Asia, not in India, so it does not apply to me and I have not registered. If I were ever considered for an Indian board, I would register and meet its requirements at that point.
I would bring a board the view of someone who has tested technology controls from outside and then run them from inside. For seven years I wrote findings for audit committees, and for fifteen I have been the executive who had to fix them. I know which kinds of finding stay open for years, and why: usually because nobody with a budget owns them, or because a test that failed was quietly rerun before anyone outside the team heard about it. I would ask about ownership and about failed tests early, and I would keep asking.
My particular experience suits companies that hold other people's personal data, rely on outsourced or offshore operations, or are growing by buying businesses in other countries. I can read a cyber risk report and say what it leaves out. I can tell a board how many people can reach its most sensitive data on an ordinary day, and how to find out if management cannot. I have negotiated IT terms into an acquisition, and I have been the CIO who inherited a deal in which nobody had. I also know the personal-data laws of six Southeast Asian countries well enough to know when a question needs counsel rather than a technologist.
There is also a gap a board should know about before it appoints me. I am not an accountant. The Singapore Code expects at least two Audit Committee members, including its chair, to have recent and relevant accounting or financial-management expertise, and I would not be one of them. My natural home is a board risk committee or a technology committee. I would join an Audit Committee only as a member adding technology-control experience, and I would want the board to be clear that it needed accounting expertise elsewhere. I would serve a year before chairing anything, because a committee chair who does not yet know the business tends to chair the agenda rather than the risk.
In June 2025 a template-mapping error during a client's migration sent 1,140 payslips of a Singapore client's employees to the wrong colleagues within the same company. Under Singapore's personal-data law, the client decides whether to notify the regulator, and we, as the processor, must tell the client without undue delay. Our general counsel wanted to wait until we had confirmed the cause, so that our first message would be complete. I argued that the client's own short deadline for assessing and notifying began only when it heard from us, and that a complete message a day later would cost it a day it did not have. We told the client within three hours, with what we knew and what we did not. The client notified the regulator and its employees. I would expect the same order of priorities from management on any board I joined.
Our first full disaster-recovery test after the Johor move, in August 2024, recovered our internal systems in nine hours against a four-hour objective. The cause was a dependency of our identity replica on a service still in Singapore. My team proposed fixing it and rerunning the test before the next Audit and Risk Committee, so that the committee would see a pass. I reported the failure instead, with the cause, the fix and the date of the retest. The retest in October recovered in three hours and twenty-five minutes. The committee chair later told me that the failed result had taught the committee more about our resilience than any pass. As a director I would ask every management team how many tests had failed in the year, and I would be wary of one that reported none.
In the Siravanna purchase I asked for a S$4.5 million holdback, and our chief strategy officer believed that figure would lose us the deal. I could have recommended walking away, and some of my findings would have supported that. I did not, because the business was worth buying and most of the risks could be fixed within a year. I accepted S$2.7 million in escrow on condition that two credential and access changes were made before closing. Those conditions turned out to matter more than the money. On a board I would try to bring the same discipline: separating the risks that should stop a decision from those that should shape its terms, and saying which is which.
Four questions would organise my first year, and I would hold myself to answering them in order.
What does this company hold that would hurt others if it escaped? Before my first meeting I would ask for the data inventory, the register of outsourced and offshore operations and the last two years of incidents, and I would read the board's risk appetite against them.
Who can reach those things today? In the first quarter I would ask management to show the committee how many people, contractors and suppliers can reach the most sensitive data and systems on an ordinary day, and how that number is controlled. If nobody can answer quickly, that is the first piece of work.
Which tests have failed? By mid-year I would want to see every recovery, access and penetration test from the previous year, passed and failed, and the dates of any retests. I would meet the internal auditors and the chief information security officer without management present, if the committee's practice allowed.
Am I useful? At the end of the year I would ask the chair for direct feedback and use the board evaluation to judge whether my questions had changed any decision. Only then would I consider chairing a committee.
Three groups of company are closed to me. The first is anything that competes with Amarisca: payroll, HR software, employer-of-record and HR outsourcing businesses anywhere in Southeast Asia. The second is any material client of Amarisca, any supplier I have chosen or manage, including our cloud, colocation and software providers, and any company in Jantaris Growth Partners' portfolio. The third is any company that is negotiating with Amarisca, or that Amarisca is evaluating as an acquisition, which I would check with our chief strategy officer before every approach without telling him the company's name unless it were already public.
I hold share options in Amarisca, and I sit on the boards of Siravanna and of Sevaline Learning Trust. I would disclose all three before any appointment and seek the consent of Amarisca's board.
If a conflict appeared after I joined, for example because the company began buying payroll services from Amarisca, I would tell the chair before the next meeting, leave the room for that item and resign if the relationship was likely to recur. Time is a conflict too. Our year-end tax season and the company's results calendar will collide, so I would fix twenty-four days a year in advance and decline a second seat.
My employment, shareholding and directorships are tied to Amarisca, Siravanna and Sevaline Learning Trust, and to nothing else. Before any appointment I would list every relationship between a prospective company and those three, and with Jantaris Growth Partners and its portfolio, and leave the board to judge my independence against the Singapore Code of Corporate Governance and SGX rules. If those facts changed during my term, I would tell the chair before the next meeting.