IT Security Engineer: Pen Testing, Cloud & Zero Trust

CITIC Securities International Company Limited; Hong Kong Island; On-site; HKD 420,000 - 640,000; Full time

Job summary

CITIC CLSA is seeking an IT Security Analyst to join an international security team in Hong Kong. You will manage a portfolio of security controls, conduct penetration testing and vulnerability management, and support design and operation of cyber security programs across on‑prem and cloud environments.

The role requires hands-on experience with security testing tools, strong English and Chinese communication, and the ability to collaborate with IT and business units on risk remediation and

Qualifications

• Bachelor degree in IT/CS or related field.
• 3-5 years of cybersecurity experience with regulatory knowledge preferred.
• Certifications such as CISSP/CISA/CISM are a plus; offensive security certs are advantageous.

Responsibilities

• Conduct penetration testing, vulnerability scanning and code reviews on IT systems and technologies.
• Perform architecture reviews and security assessments of IT systems’ designs and configurations (On-Prem and Cloud).
• Conduct cyber-attack simulations using red/blue/purple team exercises.
• Prepare reports with identified vulnerabilities and remediation recommendations.
• Assist in evaluating, designing and implementing security controls including MFA, PKI, WAFs and IAM.

Skills

Penetration testing

Vulnerability scanning

Security assessments

Red team exercises

Cloud security

Education

Bachelor Degree in IT/CS

Tools

Burp Suite

Metasploit

ZAP

Nessus

Nmap

Qualys

Job description

CITIC CLSA is seeking an IT Security Analyst to join an international security team in Hong Kong. You will manage a portfolio of security controls, conduct penetration testing and vulnerability management, and support design and operation of cyber security programs across on‑prem and cloud environments.

The role requires hands-on experience with security testing tools, strong English and Chinese communication, and the ability to collaborate with IT and business units on risk remediation and