Cyber Security Manager

Main Responsibilities


-Responsible for the establishment of the cybersecurity management governance model, the definition and assignment of the key cybersecurity roles and responsibilities including but not limited to Control Owner and Control Operator, in accordance with the Bank's Risk Management Framework;
-Responsible for the management of the enterprise-level cybersecurity control architecture, includes organizing the implementation of control and the evaluation of the effectiveness of implementation;
-Support the establishment and maintenance of the cybersecurity objective, strategy and program;
- Responsible for acting as the cybersecurity specialist and consultant in any of the following domains, such as Infrastructure Network Security (Endpoint Security, Network Security, Infrastructure Security, Cloud Security, Security Operations), Application Security (DevSecOps, SSDLC, Application Security Testing), Third-party and Supply Chain Security, Security Incident Management and Threat Intelligence Analyst;
- Responsible for providing expert advice and concrete opinions to the owners of the controls in the above domains under other Clusters of the Fintech Division, e.g. IT Operation Center and IT Development Center, on the design and implementation of the controls;
- Responsible for conducting the security review to the overall cybersecurity control design of the Bank



Requirements


- Degree holder in Cyber Security / Computer Science / Information Technology or related discipline;
- Minimum 8 years or above of relevant experience in Cyber Security Management / Cyber Security Operations / Technology Risk Management or IT Audit, preferably with experience gained from consultancy / banking / finance industry; appropriate candidate with abundant experience may be considered as the team leader;
- Experience in consultancy preferably Big 4 or IT Auditing is an advantage
- Strong understanding of the best practices of cybersecurity management and controls;
- Sound technical knowledge of security domains, such as Infrastructure Network Security (Endpoint Security, Network Security, Infrastructure Security, Cloud Security, Security Operations), Application Security (DevSecOps, SSDLC, Application Security Testing), Third-party and Supply Chain Security, Security Incident Management and Threat Intelligence Analysis etc; Experience in managing and administering cybersecurity tools is an advantage;
- Keep abreast of emerging cyber threats and cybersecurity controls/products/solutions;
- Holder of HKMA ECF-C recognized certifications at professional level is required, such as CISA, CISM, CRISC, CISSP, CCSP, OSCP, etc;
- Holder of ISO/IEC 27001 related certificates is an advantage;
- Customer-oriented, good communication and interpersonal skills;
- Able to work independently and under pressure with tight deadline;
- Strong problem-solving, analytical skills and presentation skills;
- Good command of written and spoken English and Mandarin;
- Proficiency in preparing management dashboard / reporting deck and reports in Chinese is definitely an advantage;
Applicants who are not contacted within 8 weeks may consider their applications unsuccessful and their personal data will be retained by the bank for a period up to two years.


All information provided by applicants will be used for recruitment purposes only and will be used strictly in accordance with the bank's personal data policies, a copy of which will be provided upon request.