Security Assurance Lead: Risk, Testing & Governance

Cathay Pacific Airways Limited; Hong Kong; On-site; HKD 900,000 - 1,100,000; Full time

Job summary

Cathay Pacific is seeking an IT Security Assurance Lead to drive security testing and assurance across initiatives. You will oversee risk-based assessments, elevate testing quality, and guide mitigation strategies for projects, vendors, and platforms.

You will mentor security teams, enhance assurance frameworks, and promote secure development practices to strengthen Cathay Pacific's resilient technology landscape.

Qualifications

• 5-7 years in IT Security Assurance, security testing or risk assessment.
• Experience leading small teams and mentoring teammates.
• Certification such as OSCP, GWAPT, OSEP, OSWE, OSCE or CEH preferred.
• Expert knowledge of cyber threats, testing methods, standards and tools.
• Strong vendor management for external testing providers.
• Hands-on use of vulnerability assessment, penetration testing and OWASP.

Responsibilities

• Lead IT security risk assessments and assurance activities, track risks and mitigations.
• Advise stakeholders on residual risks, vulnerabilities, and non-compliance.
• Evaluate risks from exceptions and recommend mitigations.
• Develop and improve security assessment frameworks and testing standards.
• Oversee security testing delivery across projects and BAU activities.
• Manage external testing vendors and testing tools quality.

Skills

IT Security Assurance

Security Testing

Risk Assessment

Vendor Management

Penetration Testing

Ethical Hacking

Threat Awareness

Leadership

Education

Certifications in security (OSCP/GWAPT/CEH)

Tools

NIST

OWASP

OSSTMM

OSINT

Job description

Cathay Pacific is seeking an IT Security Assurance Lead to drive security testing and assurance across initiatives. You will oversee risk-based assessments, elevate testing quality, and guide mitigation strategies for projects, vendors, and platforms.

You will mentor security teams, enhance assurance frameworks, and promote secure development practices to strengthen Cathay Pacific's resilient technology landscape.