Assistant Vice President (AVP), Information Security Governance

Hong Kong Exchanges and Clearing Limited; Tseung Kwan O; On-site; HKD 900,000 - 1,300,000; Full time

Job summary

Hong Kong Exchanges and Clearing Limited is seeking a senior information security governance professional to lead configuration baselines, CIS benchmark alignment, and security controls across the enterprise.

You will manage security exceptions, approval workflows, and key management governance, while ensuring compliance with regulatory requirements and industry best practices in a fast-paced financial markets environment.

Qualifications

• Minimum 10 years of experience in information security governance, risk management or IT audit in financial services or regulated environments.
• Strong understanding of CIS Benchmarks and security governance processes.
• Excellent analytical, communication, and stakeholder management skills.

Responsibilities

• Manage and maintain enterprise security configuration standards and baselines.
• Administer security exception management with business justification and risk assessment.
• Perform governance and approval activities to ensure security standards are met.
• Review and approve website, file upload and email whitelisting requests per policies.
• Review and approve encryption key management requests according to cryptographic standards.
• Review internal Certificate Authority certificates and ensure proper issuance and management.
• Review SUDO registration and privileged escalation requests with least-privilege principles.
• Conduct Security Acceptance Checklist reviews as part of SDLC and approve SSRs with justified requirements.
• Review and approve non-standard software installation requests with risk mitigation.

Skills

InfoSec governance

Risk management

CIS Benchmarks

Stakeholder management

Analytical skills

Education

Bachelor's degree in Information Security

Certifications: CISSP/CISM/ISO 27001 Lead

Job description

Company Introduction: We’re home to Asia's most dynamic and vibrant capital markets. Connecting capital, ideas, inspiration and innovation for deeper, more diverse and liquid global capital markets; providing greater choice and opportunity for our customers, each and every day. HKEX is a purpose-driven company. Our commitment to the long-term development of our business and our markets is articulated in our purpose: "To Connect, Promote and Progress our Markets and the Communities they support for the prosperity of all."

Job Summary

Job Duties:

Security Configuration

Manage and maintain enterprise security configuration standards and baselines. Review and adopt the latest Center for Internet Security (CIS) Benchmarks, ensuring alignment with HKEX security requirements. Oversee updates to security configuration scanning tools to incorporate the latest CIS Benchmarks and security checks. Develop, review, and maintain Generic Security Baselines (GSBs) for technologies and platforms not covered by CIS Benchmarks. Ensure security configuration standards remain current, effective, and aligned with industry best practices and regulatory requirements.

Security Exception Management

Administer the security exception management process for security findings. Review and validate exception requests to confirm that appropriate business justification, risk assessment, compensating controls, and management approvals are in place. Assess and validate potential false-positive findings identified through security configuration scans. Maintain accurate records of approved exceptions and monitor their validity periods and expiry dates.

Security Governance Operations and Approval

Perform governance and approval activities to ensure security standards and operational requirements are met.

Whitelisting Review

Review and approve website, file upload and email whitelisting requests in accordance with established security policies and risk management requirements.

Encryption and Key Management

Review and approve encryption key management requests and related activities according to cryptographic standards and key management requirements.

Internal Certificate Authority (CA) Governance

Review and approve requests related to internal Certificate Authority (CA) certificates and ensure proper issuance, renewal, usage, and management of digital certificates.

Privileged Elevation Governance

Review and approve SUDO registration and privileged escalation and ensure requests is granted with least-privilege and security governance principles.

Security Acceptance Review

Conduct Security Acceptance Checklist (SAC) reviews and approvals as part of the SDLC process control. Assess and approve SSR requests stating security requirements are not applicable, ensuring adequate justification and risk assessment are documented.

Non-Standard Software Assessment Review

Review and approve requests for installation of non-standard software, with evaluation of associated operational, security, compliance, and technology risks. Ensure appropriate mitigating controls are established before approval.

Job Requirement

Technical & Professional Skills

Minimum 10 years of relevant experience in in information security governance, information security, technology risk management, compliance, or IT audit functions, preferably within financial services or a regulated environment. Good understanding of information security governance, risk, and control concepts. Strong understanding of CIS Benchmarks, control principles, and security governance processes. Excellent analytical, communication, and stakeholder management skills. Ability to analyse processes and identify gaps or improvement opportunities.

Qualifications

Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, or related discipline. Relevant professional certifications such as CISSP, CISM, ISO 27001 Lead Implementer/Auditor, CCSP or equivalent are preferred.

HKEX is committed as an Equal Opportunity Employer. Diversity is one of our core values and we look to support, respect diverse perspectives, abilities, culture and experiences within our workplace.

Location: HKEX - TKO Shift: Standard - 40 Hours (Hong Kong SAR) Scheduled Weekly Hours: 40 Worker Type: Permanent

Hong Kong Exchanges and Clearing Limited (HKEX) is a publicly-traded company (HKEX Stock Code:388) and one of the world’s leading global exchange groups, offering a range of equity, derivative, commodity, fixed income and other financial markets, products and services, including the London Metals Exchange. As a superconnector and gateway between East and West, HKEX facilitates the two-way flow of capital, ideas and dialogue between China and the rest of world, through its pioneering Connect schemes, increasingly diversified product ecosystem and its deep, liquid and international markets. HKEX is a purpose-led organisation which, across its business and through the work of HKEX Foundation, seeks to connect, promote and progress its markets and the communities it supports for the prosperity of all. Discover the latest career opportunities and programmes at HKEX.