Information Security Manager

NTT Com Asia; Hong Kong; On-site; HKD 900,000 - 1,500,000; Full time

Job summary

NTT Com Asia is seeking a senior InfoSec professional to manage the technical domain of information security across the company. You will drive security governance, risk, and compliance for IT and OT environments, leading incident response and continuous improvement.

The role requires strong technical security expertise, the ability to influence stakeholders, and a proactive mindset to implement best-practice controls across a large enterprise in Hong Kong.

Qualifications

• 5+ years in information and cybersecurity within an enterprise environment.
• Hands-on with security tooling for incident response and vulnerability management.
• Experience across IT and OT security, governance and risk controls.
• Security certifications such as CISSP or CISM are required, CCNP/MCSE preferred.

Responsibilities

• Review company-wide information security policies, procedures and standards for alignment with market standards and group policies.
• Lead interdepartmental security stakeholders to ensure compliance for IT/OT systems and applications.
• Oversee continuous monitoring of systems for breaches, access, and vulnerabilities.
• Identify vulnerabilities, advise mitigations, and coordinate remediation plans.
• Coordinate incident response leadership during cyber incidents and post-incident improvement.

Skills

InfoSec leadership

Incident response

Vulnerability management

Cloud security

Compliance knowledge

Education

Degree in Computer Science/IT/Engineering

Tools

SIEM/SOC tools

Nessus/Defender/Qualys

PAM/Cloud security tools

Job description

A senior professional within InfoSec Management who responsible for managing technical domain of the company-wide information security. Developing and maintaining best practice security measures ensuring robust security compliance throughout the whole company. This role requires a proactive individual with a strong technical security background and a passion for continuous improvement.

Job Responsibilities

• Review the company-wide information security policies, procedures and standards to ensure the alignment with market standards and Group policies
• Provide leadership and consulting to multiple interdepartmental security stakeholders including guidance and instruction to ensure all IT and OT critical systems/applications compliance with information protection from government ordinance and industry regulations
• Oversee continuous monitoring of IT and OT systems/applications for security breaches, unauthorized access, malicious activities, vulnerability patching, etc.
• Identify potential security vulnerabilities and assess risks, advise system owners to deploy appropriate mitigation and protection
• Lead incident owners in responding to security incident or cyber-attacks, analyzing the causes and collaborating with system/application owners to implement remedial action and improvement plan
• Conduct deep-dive checking and audit of daily operation by reviewing system logs, participating implementation, preview & post-check of critical configuration change in view of security

Job Requirements

• Degree in Computer Science, Information Technology, Computer Engineering or related disciplines
• 5+ years of increasingly responsible experience in information & cybersecurity in enterprise environment covering application systems and Infrastructure with proven record in information security management role
• Hand on experience of the security tools in Incident Response (SIEM, SOC, Sentinel), vulnerability management (Nessus, Defender, Qualys), Network & Endpoint security (Firewall, Zscaler, EDR), Identity and Access (PAM) and Cloud Security (Azure and AWS)
• Holder of Security certification such as CISSP, CISM is a MUST
• Holder of Certification such as CCNP, MCSE is preferrable
• With experience in Expert engineer level on security technology solutions for the company across a range of information security areas such as IDS/IPS. SIEM, Firewall, and antivirus
• Capable to perform operating system, network and application vulnerability assessments
• Practical knowledge on intrusion detection methodologies, techniques & tools for detecting host and network-based intrusions
• Good knowledge of ITILv3, ISO27001, cybersecurity technologies and emerging threat vectors
• Able to work under pressure and handle multi-tasks without compromising quality
• Be open mind and willing to take challenge from adopting new technologies and re-engineering

This role will lead the system integration business end to end, with accountability for strategy, commercial performance, solution delivery, customer engagement, governance, service transition, partner management, and team capability development.