AVP/VP - Cyber Risk, Operational Risk & Resilience

Hong Kong Exchanges and Clearing Limited; Hong Kong; On-site; HKD 1,200,000 - 1,900,000; Full time

Job summary

Hong Kong Exchanges and Clearing Limited is seeking a senior risk professional to oversee cyber, data and AI risk for the Group. You will provide independent second-line oversight, advise on material exposures and coordinate risk-driven activities to strengthen resilience.

You will lead risk assessments, manage red-team testing, monitor indicators and report to governance committees, while advancing responsible AI governance and data resilience across the organisation.

Responsibilities

• Identify, assess and monitor cyber, data and AI risks; provide independent advice and escalate exposures with mitigations.
• Monitor, develop and report key cyber risk indicators and trends; escalate insights where appropriate.
• Coordinate external threat-led red-team testing; challenge scope, scenarios, coverage, independence and findings.
• Assess ITD's defence-in-depth across identity, network, endpoint, data, cloud and recovery controls; identify single points of failure.
• Develop and coordinate cyber tabletop and crisis-simulation activities; capture lessons and follow-up actions.
• Provide independent insight supporting responsible AI governance and resilience risks; monitor AI threats.
• Support data governance and risk management journey by advising on data confidentiality, integrity, availability and quality.

Job description

Company Introduction

We’re home to Asia's most dynamic and vibrant capital markets. Connecting capital, ideas, inspiration and innovation for deeper, more diverse and liquid global capital markets; providing greater choice and opportunity for our customers, each and every day. HKEX is a purpose-driven company. Our commitment to the long-term development of our business and our markets is articulated in our purpose: "To Connect, Promote and Progress our Markets and the Communities they support for the prosperity of all."

Job Summary

Provide independent second-line oversight, advice and constructive challenge over the Group's management of cyber, AI and data risks. Lead cyber, data and AI risk assessments, second line external red team testing and cyber drills / table top exercises, provide emerging-risk analysis and report material risks to senior management and governance committees.

Job Duties

• Identify, assess and monitor material cyber, data and AI risks; provide independent advice and constructive challenge to ITD and other first-line owners, and **escalate** significant exposures with recommendations for mitigation and remediation.
• Monitor, develop and report key cyber risk and performance indicators, escalating trends and providing risk insights where appropriate.
• Coordinate and oversee risk-based external threat led red-team and adversarial security testing; challenge scope, scenarios, coverage, independence, findings and residual risk.
• Assess and challenge ITD's defence-in-depth approach across identity, network, endpoint, application, data, cloud, third-party and recovery controls, including attack paths, dependencies, monitoring, containment and potential single points of failure, including thematic risk assessments of key risk areas and control initiatives.
• Develop and coordinate cyber tabletop and crisis-simulation activities that test decision-making, escalation, regulatory notification, communications, recovery and dependencies; capture lessons and monitor material follow-up actions.
• Provide independent insight supporting responsible AI governance, assess cybersecurity, data, model, third-party, human-oversight and resilience risks, and monitor emerging AI-enabled threats.
• Support the Group's data governance and data risk management journey by advising on data confidentiality, integrity, availability, classification, access, lineage, quality, retention, sharing and resilience.
• Review incidents, threat intelligence, vulnerabilities, testing and regulatory developments; initiate thematic reviews, translate technical issues into business and resilience implications, report to senior management and governance committees, and lead significant workstreams and stakeholder engagement.

Equal Opportunity

HKEX is committed as an Equal Opportunity Employer. Diversity is one of our core values and we look to support, respect diverse perspectives, abilities, culture and experiences within our workplace.

Location and Working Hours

Location: HKEX - Exchange Square
Shift: Standard - 40 Hours (Hong Kong SAR)
Scheduled Weekly Hours: 40
Worker Type: Permanent

Company Overview

HKEX is a publicly-traded company (HKEX Stock Code:388) and one of the world’s leading global exchange groups, offering a range of equity, derivative, commodity, fixed income and other financial markets, products and services, including the London Metals Exchange. As a superconnector and gateway between East and West, HKEX facilitates the two-way flow of capital, ideas and dialogue between China and the rest of world, through its pioneering Connect schemes, increasingly diversified product ecosystem and its deep, liquid and international markets. HKEX is a purpose-led organisation which, across its business and through the work of HKEX Foundation, seeks to connect, promote and progress its markets and the communities it supports for the prosperity of all.

Unauthorised access or use is prohibited. HKEX reserves the right to take appropriate action against any offenders.