Assistant Vice President (AVP), Information Security Governance

Hong Kong Exchanges and Clearing Limited (HKEX); Hong Kong; On-site; HKD 1,000,000 - 1,600,000; Full time

Job summary

Hong Kong Exchanges and Clearing Limited (HKEX) is seeking an experienced security governance professional to lead enterprise security configuration standards, CIS Benchmark adoption, and exceptions management within a regulated financial services environment. The role also covers encryption/key management and internal CA governance, requiring strong analytical and stakeholder skills.

The ideal candidate will have 10+ years of information security governance experience, familiarity with CIS

Qualifications

• Minimum 10 years of experience in information security governance, risk management or IT audit in financial services or regulated environments.
• Strong understanding of CIS Benchmarks and security governance processes.
• Excellent analytical and communication skills with stakeholders.
• Ability to assess gaps and drive improvement opportunities.
• Experience in encryption, key management and certificate governance.

Responsibilities

• Manage and maintain enterprise security configuration baselines and CIS alignment.
• Administer security exception management with business justification and approvals.
• Oversee governance operations and approval processes for security standards.
• Review and approve website, file upload and email whitelisting requests.
• Oversee encryption and key management governance and internal CA governance.

Skills

Info security governance

Risk management

CIS Benchmarks

Stakeholder management

Analytical thinking

Education

Bachelor’s degree in Information Security or related field

CISSP, CISM, ISO 27001 Lead Implementer/Auditor, CCSP or equivalent

Job description

Company Introduction:

We’re home to Asia’s most dynamic and vibrant capital markets.
Connecting capital, ideas, inspiration and innovation for deeper, more diverse and liquid global capital markets; providing greater choice and opportunity for our customers, each and every day.

HKEX is a purpose-driven company. Our commitment to the long-term development of our business and our markets is articulated in our purpose: “ToConnect,PromoteandProgressour Markets and the Communities they support for the prosperity of all.”

Job Summary:

Job Duties:

Security Configuration

• Manage and maintain enterprise security configuration standards and baselines.

• Review and adopt the latest Center for Internet Security (CIS) Benchmarks, ensuring alignment with HKEX security requirements.

• Oversee updates to security configuration scanning tools to incorporate the latest CIS Benchmarks and security checks.

• Develop, review, and maintain Generic Security Baselines (GSBs) for technologies and platforms not covered by CIS Benchmarks.

• Ensure security configuration standards remain current, effective, and aligned with industry best practices and regulatory requirements.

Security Exception Management

• Administer the security exception management process for security findings.

• Review and validate exception requests to confirm that appropriate business justification, risk assessment, compensating controls, and management approvals are in place.

• Assess and validate potential false-positive findings identified through security configuration scans.

• Maintain accurate records of approved exceptions and monitor their validity periods and expiry dates.

Security Governance Operations and Approval

• Perform governance and approval activities to ensure security standards and operational requirements are met.

Whitelisting

• Review and approve website, file upload and email whitelisting requests in accordance with established security policies and risk management requirements.

Encryption and Key Management

• Review and approve encryption key management requests and related activities according to cryptographic standards and key management requirements.

Internal Certificate Authority (CA) Governance

• Review and approve requests related to internal Certificate Authority (CA) certificates and ensure proper issuance, renewal, usage, and management of digital certificates.

Privileged Elevation Governance

• Review and approve SUDO registration and privileged escalation and ensure requests is granted with least-privilege and security governance principles.

Security Acceptance Review

• Conduct Security Acceptance Checklist (SAC) reviews and approvals as part of the SDLC process control.

• Assess and approve SSR requests stating security requirements are not applicable, ensuring adequate justification and risk assessment are documented.

Non-Standard Software Assessment

• Review and approve requests for installation of non-standard software, with evaluation of associated operational, security, compliance, and technology risks. Ensure appropriate mitigating controls are established before approval

Job Requirement:

Technical & Professional Skills

• Minimum 10 years of relevant experience in in information security governance, information security, technology risk management, compliance, or IT audit functions, preferably within financial services or a regulated environment.

• Good understanding of information security governance, risk, and control concepts.

• Strong understanding of CIS Benchmarks, control principles, and security governance processes.

• Excellent analytical, communication, and stakeholder management skills.

• Ability to analyse processes and identify gaps or improvement opportunities.

Qualifications

• Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Information Technology, or related discipline.

• Relevant professional certifications such as CISSP, CISM, ISO 27001 Lead Implementer/Auditor, CCSP or equivalent are preferred.

HKEX is committed as an Equal Opportunity Employer. Diversity is one of our core values and we look to support, respect diverse perspectives, abilities, culture and experiences within our workplace.

Location:

HKEX - TKO

Shift:

Standard - 40 Hours (Hong Kong SAR)

Scheduled Weekly Hours:

40

Worker Type:

Permanent