IT Cyber Security Manager (Vulnerability Management)

Recruit Squad Limited; Hong Kong; Sur place; HKD 800 000 - 1 300 000; Plein temps

Résumé du poste

Recruit Squad Limited is seeking an IT Cyber Security Manager (Vulnerability Management) to lead our vulnerability programs in a hybrid IT environment. You will manage scanning, assessment, prioritisation and remediation, and work closely with IT teams and vendors to implement robust security controls.

The role requires 7+ years in IT security focusing on vulnerability/threat exposure management, strong CVE interpretation, patch management experience, and relevant cybersecurity certifications.

Qualifications

• Bachelor’s or above degree in Computer Science, Information Security, Engineering or related field.
• 7+ years of experience in IT security with a focus on vulnerability management and threat exposure management.
• Proven track record of managing vulnerability management programs in complex, hybrid environments (on-prem, cloud, containerised).
• Deep proficiency in interpreting CVEs, CVSS scores, and exploit databases to assess risk.
• Experience with patch management tools and IT service management platforms for ticketing/workflow automation.
• Strong understanding of DevSecOps practices.
• Knowledge of IT systems including operating systems, databases, networks, infrastructure, containerised environments and cloud computing.
• Scripting skills for automation are advantageous.
• CISSP, CISA, or CISM-type certifications preferred.
• Familiarity with ISO 27001, NIST CSF, DPO IT Security Policy and Cybersecurity Law of PRC.
• Experience in international teams and financial services is a plus.
• Fluent in English, Cantonese, and/or Mandarin.

Responsabilités

• Lead continuous vulnerability management programs across the organisation and coordinate remediation with IT teams.
• Oversee end-to-end lifecycle of vulnerability management, including scanning, assessment, prioritisation, and continuous improvement.
• Design and optimise a comprehensive vulnerability scanning program (credentialed/non-credentialed, agent-based, internal/external).
• Implement a prioritisation framework that factors asset criticality, exposure distance, exploit availability, and data sensitivity.
• Stay current with threats, CVEs and industry best practices to adjust scan policies and prioritisation.
• Collaborate with vendors and internal stakeholders to ensure compliance and effective security solutions.
• Develop, maintain and refine operating procedures for backup, patch management, system maintenance and auditing.
• Coordinate with IT and business users to enable cybersecurity solutions.

Connaissances

Vulnerability management

Threat exposure management

CVEs & CVSS interpretation

Patch management

DevSecOps

Cloud & hybrid environments

Scripting for automation

Cybersecurity certifications

English/Cantonese/Mandarin

Formation

Bachelor's or above degree

Description du poste

IT Cyber Security Manager (Vulnerability Management)

Lead our continuous vulnerability management programs

Responsible for the end-to-end lifecycle of vulnerability management, including scanning, assessment, prioritisation, and coordination with IT teams for remediation, and continuous improvement of security

Design, administer and optimise a comprehensive vulnerability scanning program, including credentialed/non-credentialed scans, agent-based scans, internal and external vulnerability scans.

Manage a robust vulnerability and threat exposure management and prioritisation framework that goes beyond CVSS score, incorporating a range of factors such as distance from exposure, asset criticality, exploit availability, and data sensitivity, etc.

Stay current with emerging threats, CVEs and industry best practices to proactively adjust scan policies and prioritisation framework.

Participate in system integration developments and administer, support and troubleshoot cybersecurity systems.

Develop, maintain and fine-tune system operating procedures, including back-up & disaster recovery, vulnerability, update & patch management, system maintenance and monitoring and audit.

Work closely with technical vendors and internal stakeholders to ensure compliance requirements are addressed and security solutions are implemented effectively.

Coordinate and collaborate closely with IT and business users to ensure successful enablement of cybersecurity solutions.

Stay up-to-date with emerging trends and technologies in IT security and make recommendations for their adoptions.

Requirements

Bachelor’s or above degree in Computer Science, Information Security, Engineering or related field.

7+ years of experience in IT security, with a specialised focus on vulnerability management and threat exposure management.

Proven track record of management vulnerability management program in complex, hybrid environments (on-premise, cloud and containerised).

Deep proficiency in interpreting CVEs, CVSS scores, and exploit databases to assess risk.

Proven experience with patch management tools and IT service management platforms for ticketing and workflow automations.

Strong understanding on DevSecOps practices.

Strong understanding of computer systems, including operating systems, databases, network, infrastructure, containerised environment and cloud computing.

Scripting skills for automation is advantageous.

Cybersecurity certificates such as CISSP, CISP, or CISA, are highly preferred.

In-depth knowledge of IT security frameworks and standards such as ISO 27001, NIST Cybersecurity Framework, Digital Policy Office (DPO) IT Security Policy, and Cybersecurity Law of the People’s Republic of China.

Experience in working in an international team, with solid grounding in financial service is a plus

Fluent in English, Cantonese, and/or Mandarin

Working location in Hong Kong