Security Assurance Lead: Pen Testing & Risk Oversight

Cathay Pacific Group; Hong Kong; On-site; HKD 900,000 - 1,400,000; Full time

Job summary

Cathay Pacific Group seeks an experienced IT Security Assurance leader to drive risk assessments, testing, and mitigation across the technology landscape. You will oversee security testing activities, mentor a team of specialists, and coordinate with internal security teams and business units to embed secure practices throughout delivery lifecycles.

Responsibilities include leading assessments, managing incidents, enhancing testing frameworks, and ensuring vendor delivery quality while aligning

Qualifications

• 5–7 years of experience in IT security assurance and testing with leadership exposure.

Responsibilities

• Lead IT risk and security assessments, tracking and driving mitigation of issues.
• Communicate residual risks, vulnerabilities, and noncompliance to senior management.
• Provide expertise in resolving security incidents and exceptions.
• Develop and maintain security assessment frameworks, methodologies, and testing procedures (cloud/contractual).
• Oversee and enhance security testing frameworks across projects and operations.
• Manage quality of vendor and internal testing, reviewing test criteria and coverage.
• Prioritize and allocate testing resources to meet timelines based on risk.
• Mentor and manage team members, supporting capability development.
• Monitor evolving threats and adapt assurance approaches.
• Collaborate to improve testing methods and promote secure coding practices.

Skills

IT risk assessment

Penetration testing

Security testing

Vendor management

Communication

Team leadership

Threat intelligence

Security frameworks

Incident response

Tools

Penetration testing tools

Job description

Cathay Pacific Group seeks an experienced IT Security Assurance leader to drive risk assessments, testing, and mitigation across the technology landscape. You will oversee security testing activities, mentor a team of specialists, and coordinate with internal security teams and business units to embed secure practices throughout delivery lifecycles.

Responsibilities include leading assessments, managing incidents, enhancing testing frameworks, and ensuring vendor delivery quality while aligning