Tech
Manager, Information Security
Responsibilities:
Conduct regular risk and security maturity assessment, maintain IT risk registry, and formulate regular work plan to mitigate risk and ensure security compliance
Develop security operation model and team structure, and evaluate appropriate solutions for integration
Monitor budget and deliver IT risk reduction and security projects. Manage day-to-day operations on security incidents, vulnerabilities reduction and exemptions
Recommend security requirements for IT & Business project implementation, and mediations based on compliance results
Provide technical advice on solution implementation & operations, e.g., security management, system software obsolescence, disaster recovery, business continuity planning etc.
Monitor IT risk and security operations regularly, and manage outsourced SOC and any security outbreak
Work closely with the group on security awareness promotion and work on IT risk & security related user communications
Requirements:
A Bachelor’s degree in Computer Science, Information Technology or related discipline
At least 8 years of experience in IT infrastructure projects and operations, with at least 3 years in Information Security and team leadership experience
Professional qualifications such as CISSP, CISA, CISM or CEH would be desirable
Solid experience in IT governance, risk and compliance management, and security solutions planning, evaluation and roll-out
Hands-on experience in security monitoring and operation e.g. Vulnerability Scanning, DLP/EDR, NGFW, IDS/IPS, CASB, WAF, Privileged Access Management, SIEM, SOC/SOAR, Active Directory Security
Strong understanding of NIST CSF, SANS, CIS, ISO27001 or related security frameworks
Experience in Cloud Security, such as Azure Security, AWS Security, Microsoft 365 Security would be advantageous
Excellent communication skills in both written and spoken English and Chinese. Fluent Putonghua is desirable
