Senior Technical Manager, Vulnerability Management (Penetration Testing)

Global Sports Jobs Limited; Hong Kong; On-site; HKD 900,000 - 1,300,000; Full time

Benefits offered by this job

Competitive benefits package

Dynamic working environment

Development opportunities

Job summary

The Hong Kong Jockey Club IT Division, within Cyber Security, is seeking an experienced Senior Penetration Tester to lead end-to-end engagements and mentor teams across HK and Shenzhen. You will perform tests on applications, infrastructure, and cloud platforms, deliver actionable remediation guidance, and help strengthen security posture.

The role requires 10+ years in penetration testing and certifications such as OSCP/OSCE/CEH, hands-on tooling, and strong communication with stakeholders.

Qualifications

• 10+ years in penetration testing and vulnerability management across multiple domains.
• Certification in one or more of OSCP/OSCE/OSWE/GPEN/CEH/CISSP/CISA or equivalent.
• Hands-on experience with standard securit y tooling and workflows.

Responsibilities

• Lead end-to-end penetration testing engagements across apps and infrastructure.
• Act as SME, supporting requests and project requirements.
• Perform and coordinate tests including web/mobile apps, infrastructure, and cloud security.
• Identify, validate and exploit vulnerabilities, developing effective remediation guidance.
• Develop scripts and tooling to test resilience and strengthen controls.
• Deliver detailed reports and communicate remediation priorities to stakeholders.

Skills

OSCP

OSCE

OSWE

GPEN

CEH

CISSP

CISA

Penetration testing

Vulnerability management

Reverse shells / C2

Education

University degree in CS/IT/cybersecurity

Tools

Kali Linux

Burp Suite

Qualys

Nessus

Nmap

Metasploit

Wireshark

Job description

About the Role

The role sits within the IT Division of The Hong Kong Jockey Club, a community of over 1,500 professionals working collaboratively across Hong Kong and Shenzhen. It is part of the Cyber Security Department, which safeguards information assets, IT systems, networks, and cloud platforms while ensuring resilience, continuity, and compliance with regulatory requirements in Hong Kong and China. The role leads and oversees penetration testing engagements end-to-end and acts as a subject matter expert for penetration testing and vulnerability management. It performs and coordinates testing and assessments, delivers reporting and metrics, manages vendor relationships, and supports broader cybersecurity initiatives to strengthen the Club's security posture.

Key Responsibilities

• Lead and oversee penetration testing engagements end-to-end, ensuring high-quality execution across applications and environments to uncover and address security weaknesses.
• Act as a trusted Subject Matter Expert, supporting penetration testing requests, anticipating project requirements, and providing practical, effective solutions.
• Perform and coordinate penetration testing and vulnerability assessments, including system and infrastructure security reviews, web application penetration testing, mobile application security testing, and vulnerability scanning and prioritisation.
• Identify, validate, and exploit vulnerabilities using advanced manual techniques and automated tools to strengthen security posture.
• Develop and refine custom scripts, payloads, and exploits to test resilience against security controls.
• Deliver detailed technical reports and remediation guidance aligned with organisational cybersecurity standards, and engage stakeholders to communicate findings and remediation priorities, tracking progress to timely closure.
• Design and maintain dashboards and metrics (KRIs) to monitor cybersecurity posture and provide regular reporting to management.
• Contribute to the development and improvement of internal standards, methodologies, and documentation for penetration testing and vulnerability management.
• Manage vendor relationships, ensuring service quality and monitoring performance against agreed SLAs.
• Support broader cybersecurity initiatives as directed by Cyber Security Management, and promote a collaborative and inclusive team culture through cross-team efforts and cooperative behaviours.

Required Experience & Qualifications

• University degree qualification in Computer Science, Information Technology, cybersecurity, or a related discipline.
• Industry-recognised certification in one or more of OSCP, OSCE, OSWE, GPEN, CEH, CISSP, CISA, or equivalent.
• 10 years or more of working experience in the penetration testing and vulnerability management domain across various disciplines.
• Hands-on experience with industry-standard tools such as Kali Linux, Burp Suite, Qualys, Nessus, Nmap, Metasploit, and Wireshark.
• Deep technical knowledge of operating systems: Windows, Linux, and macOS.
• Deep technical knowledge of offensive tooling and techniques: implant reverse shells and Command and Control (C2) infrastructure.
• Deep technical knowledge of network and security architecture: TCP/IP, IDS/IPS, firewalls, WAFs, and web content filtering.
• Deep technical knowledge of cloud platform security: integrated security solutions across major cloud providers (e.g. AWS, Azure).
• Deep technical knowledge of application security: coding practices and architecture design.
• Demonstrated ability to perform penetration testing, vulnerability assessments, and security reviews for applications and infrastructure.
• Proven expertise in conducting application security assessments across web, mobile, and self-developed applications.
• Strong service and customer-focused approach to the service being delivered.
• Excellent interpersonal, collaborative and communication skills.
• Well-disciplined with exemplary professional competence and integrity.

Preferred Skills

• Experience participating in red team operations is desired.
• Exploit research and development skills are a plus.
• Source code review experience is a plus.

Workplace

• Working collaboratively across Hong Kong and Shenzhen.

Salary

• Competitive salary.

Benefits & Perks

• Competitive benefits package.
• Dynamic working environment.
• Development opportunities.