Responsibilities:

Governance and Planning:

• Preparing and formalising security policies, standards & guidelines in adherence to organizational and statutory requirements;

• Planning the overall security measure in system application and platform landscape;

• Advising IT Management on strategic issues, latest security trends on system application and infrastructure;

• Outlining and refining security related policies and procedures, ensure consistency and use of best practices in design and build of application and infrastructure;

• Ensuring security policies are adhered to by all users and vendors and continually reviewed; and

• Be a gatekeeper in Architecture Governance Board to enforce system security.

Enforcement and Operations:

• Security Control: adopting and practising appropriate IT security measures based on current issues and best practices identified globally, regionally, by auditors and external influences;

• Risk Assessment: assist on staffing the competent resources to operationalise regular risk assessments and vulnerability assessments to identify and address potential threats to IT systems and data;

• Incident Response: implementing the incident response plan to effectively manage and mitigate cybersecurity incidents;

• Training & Awareness: organising training programs to enhance awareness of cybersecurity risks and best practices among employees;

• Stakeholder Engagement: collaborating with other departments to ensure cybersecurity awareness and best practices across the organization; and

• Reporting: providing regular and succinct updates to IT management and the executives regarding the organization's risk posture and cybersecurity incidents.

Financial Controls:

• Ensuring compliance to the standard procurement and budget management processes for security project initiatives and operational spending;

• Reviewing business case for proposed initiatives to ensure all relevant costs and services required for deployment, operations and support are justified with viable solution options comparison;

• Managing vendor performance to leverage and optimize investments;

• Reviewing costs and identify cost saving opportunities which do not impact the strategic vision; and

• Authorizing all technology related purchases and capital expenditure based on company’s authorization limits and policies.

Job Requirements:

• Possess a recognised university degree in Information Security, Computer Science or equivalent;

• Have at least 8 years of IT experience, with at least 3 years in managing IT security or related role;

• Possess strong knowledge of information security principles, frameworks, and best practices (e.g., ISO 27001, CIS Controls);

• Have experience with security tools and cloud technologies such as: Ops in AWS, MS Azure, Ali, Google Cloud; Firewall solutions; Web application firewall solutions; Security information and event management (SIEM) solution;

• Possess technical knowledge of operating systems, networking, firewalls, encryption, and other cybersecurity concepts;

• Preferably be certified with qualifications such as CISSP, CISM or CISA;

• Be proficiency in English and Cantonese verbal and written communication skills, with the ability to articulate complex technical concepts to non-technical stakeholders; and

• Have experience in vendor management and liaison.