AVP, Information Security Governance & Controls

Hong Kong Exchanges and Clearing Limited (HKEX); Hong Kong; On-site; HKD 900,000 - 1,500,000; Full time

Job summary

Hong Kong Exchanges and Clearing Limited (HKEX) is seeking an experienced information security professional to lead governance, risk management and configuration controls. The role will drive security baselines, exception handling, and policy compliance within the exchange’s technology stack.

Responsibilities include reviewing CIS Benchmarks, maintaining baselines, and overseeing encryption and CA governance, with emphasis on least-privilege and regulatory alignment.

Qualifications

• 10+ years of experience in information security governance, risk management, or IT audit.
• Strong knowledge of CIS Benchmarks and security governance processes.
• Excellent analytical, communication, and stakeholder management skills.
• Bachelor’s degree in Information Security, Cybersecurity, Computer Science, or related field.
• Relevant certifications such as CISSP, CISM, ISO 27001 Lead Implementer/Auditor, CCSP preferred.

Responsibilities

• Manage and maintain enterprise security configuration standards and baselines.
• Review CIS Benchmarks and align with HKEX security requirements.
• Oversee updates to configuration scanning tools for latest CIS Benchmarks.
• Develop and maintain Generic Security Baselines for technologies not covered by CIS.
• Ensure security standards remain current, effective, and aligned with best practices and regulatory requirements.
• Administer the security exception management process with proper justification and approvals.
• Validate potential false positives from scans and maintain exception records.
• Perform governance and approval activities to meet security standards and operational needs.
• Review and approve whitelisting requests per policy.
• Review and approve encryption key management requests.
• Review internal CA certificates requests and ensure proper issuance and renewal.
• Review SUDO registrations and privileged escalation requests with least-privilege.
• Conduct Security Acceptance Checklist reviews as part of SDLC.
• Review requests for non-standard software ensuring risk and mitigations.

Skills

InfoSec governance

Risk management

Compliance

IT audit

CIS Benchmarks

Stakeholder management

Analytical skills

Communication

Process analysis

Education

Bachelor's degree in Information Security / Cybersecurity

CISSP / CISM / ISO 27001 Lead Implementer/Auditor / CCSP certifications preferred

Job description

Hong Kong Exchanges and Clearing Limited (HKEX) is seeking an experienced information security professional to lead governance, risk management and configuration controls. The role will drive security baselines, exception handling, and policy compliance within the exchange’s technology stack.

Responsibilities include reviewing CIS Benchmarks, maintaining baselines, and overseeing encryption and CA governance, with emphasis on least-privilege and regulatory alignment.