Assistant Vice President (AVP), Information Security Governance

Hong Kong Exchanges and Clearing Limited (HKEX); Hong Kong; On-site; HKD 1,200,000 - 2,000,000; Full time

Job summary

Hong Kong Exchanges and Clearing Limited (HKEX) is seeking a senior Information Security Governance professional to lead security baselines, CIS Benchmark alignment and exception management within our risk-aware environment in Hong Kong.

You will manage enterprise security configuration standards, oversee scans, approve non-standard software and ensure regulatory alignment while collaborating with stakeholders across the business.

Qualifications

• 10+ years in information security governance, risk management, compliance or IT audit.
• Strong knowledge of CIS Benchmarks and security governance processes.
• Excellent analytical, communication and stakeholder management skills.
• Ability to identify gaps and drive security improvements.

Responsibilities

• Manage and maintain enterprise security configuration standards and baselines.
• Review CIS Benchmarks and align with HKEX security requirements.
• Oversee updates to security configuration scanning tools for CIS Benchmarks.
• Develop, review, and maintain Generic Security Baselines for uncov­ered tech.
• Ensure security standards remain current and aligned with best practices and regulatory requirements.
• Administer the security exception management process and approvals.
• Review exception requests with business justification and risk assessment.
• Review and approve internal CA or privileged elevation governance requests.
• Conduct Security Acceptance Reviews as part of the SDLC process control.

Skills

Governance

Risk Management

Information Security

Stakeholder Management

Analytical Skills

Communication

Compliance

Security Controls

Education

Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Information Technology, or related discipline

CISSP

CISM

ISO 27001 Lead Implementer/Auditor

CCSP

Job description

Company Introduction:

We’re home to Asia’s most dynamic and vibrant capital markets.Connecting capital, ideas, inspiration and innovation for deeper, more diverse and liquid global capital markets; providing greater choice and opportunity for our customers, each and every day.

HKEX is a purpose-driven company. Our commitment to the long-term development of our business and our markets is articulated in our purpose: “ToConnect,PromoteandProgressour Markets and the Communities they support for the prosperity of all.”

Job Summary:

Job Duties:

Security Configuration

• Manage and maintain enterprise security configuration standards and baselines.

• Review and adopt the latest Center for Internet Security (CIS) Benchmarks, ensuring alignment with HKEX security requirements.

• Oversee updates to security configuration scanning tools to incorporate the latest CIS Benchmarks and security checks.

• Develop, review, and maintain Generic Security Baselines (GSBs) for technologies and platforms not covered by CIS Benchmarks.

• Ensure security configuration standards remain current, effective, and aligned with industry best practices and regulatory requirements.

Security Exception Management

• Administer the security exception management process for security findings.

• Review and validate exception requests to confirm that appropriate business justification, risk assessment, compensating controls, and management approvals are in place.

• Assess and validate potential false-positive findings identified through security configuration scans.

• Maintain accurate records of approved exceptions and monitor their validity periods and expiry dates.

Security Governance Operations and Approval

• Perform governance and approval activities to ensure security standards and operational requirements are met.

Whitelisting

• Review and approve website, file upload and email whitelisting requests in accordance with established security policies and risk management requirements.

Encryption and Key Management

• Review and approve encryption key management requests and related activities according to cryptographic standards and key management requirements.

Internal Certificate Authority (CA) Governance

• Review and approve requests related to internal Certificate Authority (CA) certificates and ensure proper issuance, renewal, usage, and management of digital certificates.

Privileged Elevation Governance

• Review and approve SUDO registration and privileged escalation and ensure requests is granted with least-privilege and security governance principles.

Security Acceptance Review

• Conduct Security Acceptance Checklist (SAC) reviews and approvals as part of the SDLC process control.

• Assess and approve SSR requests stating security requirements are not applicable, ensuring adequate justification and risk assessment are documented.

Non-Standard Software Assessment

• Review and approve requests for installation of non-standard software, with evaluation of associated operational, security, compliance, and technology risks. Ensure appropriate mitigating controls are established before approval

Job Requirement:

Technical & Professional Skills

• Minimum 10 years of relevant experience in in information security governance, information security, technology risk management, compliance, or IT audit functions, preferably within financial services or a regulated environment.

• Good understanding of information security governance, risk, and control concepts.

• Strong understanding of CIS Benchmarks, control principles, and security governance processes.

• Excellent analytical, communication, and stakeholder management skills.

• Ability to analyse processes and identify gaps or improvement opportunities.

Qualifications

• Bachelor’s degree in Information Security, Cybersecurity, Computer Science, Information Technology, or related discipline.

• Relevant professional certifications such as CISSP, CISM, ISO 27001 Lead Implementer/Auditor, CCSP or equivalent are preferred.

HKEX is committed as an Equal Opportunity Employer. Diversity is one of our core values and we look to support, respect diverse perspectives, abilities, culture and experiences within our workplace.

Location:

HKEX - TKO

Shift:

Standard - 40 Hours (Hong Kong SAR)

Scheduled Weekly Hours:

40

Worker Type:

Permanent