(Senior) Technology Risk Manager (Cyber Security Control Division)

Bank of China (Hong Kong) Limited; Hong Kong; On-site; HKD 420,000 - 750,000; Full time

Job summary

Bank of China (Hong Kong) Limited is seeking an experienced cybersecurity professional to formulate policies, manage risk, and lead incident response across geographies. The role requires coordinating with business units and regional SOC teams to strengthen security controls and manage cyber risk.

The ideal candidate will have at least 2 years in IT security within a large financial institution, relevant certifications, and familiarity with regulatory requirements such as NIST, PCI-DSS, and ISO

Qualifications

• Degree holder in Computer Science or information security related field.
• At least 2 years in IT security, risk management, compliance or IT audit in a sizable financial institution.
• Professional qualifications such as CISA, CISSP, CISM preferred.
• Familiar with security frameworks and regulatory requirements (e.g., NIST, PCI-DSS, ISO 27001).

Responsibilities

• Formulate and manage cyber security policies, standards and procedures.
• Assist in planning technology risk management strategies and work plans.
• Participate in cyber security projects for design, development and implementation.
• Conduct cyber security assessment and IT risk evaluation across controls and assets.
• Coordinate penetration tests, red/blue/purple team exercises and vulnerability assessments.
• Support cyber security incident response with local and regional SOC teams.
• Engage cross-country teams to coordinate incident response drills and risk reviews.
• Monitor and improve security operations, IAM, cloud security and threat management.
• Serve as SME to address risk issues and remediation with business units.
• Stay informed on latest threats and cyber threat intelligence.

Skills

Cybersecurity

Policy formulation

Threat modeling

Incident response

Risk assessment

Security governance

Education

Bachelor

Job description

Job No.: 499547
Employment Type: Full time
Departments: Information Technology Department
Job Functions: Information Technology

Roles and Responsibilities & Specific Requirements (Cyber Security):

• Formulate and manage cyber security policies, standards and procedures.
• Assist in planning of technology related risk management strategies, processes and work plans.
• Participate in Cyber Security projects for the design, development and implementation.
• Plan and conduct cyber security assessment and IT risk evaluation in area covering IT general controls, information asset management, access controls, cloud/server/endpoint/ network/ middleware security review. Support the implementation of security initiatives to ensure the compliance with corporate information security policies and compliance standards.
• Participate in organizing/conducting penetration test, red/blue/purple teaming exercises, vulnerability assessment, validation controls for local/overseas entities.
• Provide Cyber Security incident response operation and support, work with local & regional SOC team to seek for continuous improvement for daily Cyber Security monitoring, incident analysis & investigation, incident response operation and support.
• Experience in arrangement and co-ordination of cross-countries cyber incident response drills.
• Experience in Security operations, managing SOC, Offensive security, Container security, CSPM, Threat Hunting, OSINT, Dark Web monitoring, Malware analysis, SecOps , Digital forensics , Attack surface management, managing Cloud/ISP/On-premises Anti-DDoS solution, AI/LLM security, Threat modeling, Supply chain cybersecurity and Vulnerability management.
• Serve as a subject matter expert to support business units and cross-functional teams in identifying and addressing cybersecurity risks. Engage with various business units and teams to discuss risk issues and control gaps, and propose effective remediation strategies.
• Research and evaluate on latest security threats and Cyber Threat Intelligence, stay informed about latest developments in cyber security field.
• Familiar with technologies on Firewall, IDS, IPS, WAF, DNS Security, Email Security, SIEM, SOAR, DLP, UEBA, BAS, XDR, Deception, Generative AI/Machine Learning, Application of AI/ML/LLM/MCP/RAG libraries in Python , Zero Trust, Micro-segmentation, Unified endpoint management, SASE/SSE Solution, Database security, and Network/Cloud security are preferable.
• Willing to travel to different oversea region occasionally to conduct regional cyber security assessment, provide cyber security incident and response support as well as to participate different training / red team exercises (eg. Asia Pacific area, Shenzhen and Shanghai).

General Job Requirements:

• Degree holder in Computer Science or other degree majoring in Information Systems, or related discipline.
• At least 2 years of experience in IT security, technology risk management, compliance or IT audit function, gained from other sizable financial institutions
• Holding at least one recognized professional qualification under HKMA enhanced competency framework such as CISA, CISSP, CISM. Industry-recognized cyber security certifications ,such as OSCP/OSCE/OSWE/OSEE/GXPN/GPEN/GCPN/GCIH/GSOC/ GCFA/OSDA/CCIE/CCNP, is preferable
• Familiar with HKMA TM-E-1, TM-C-1, TM-G-1, C-RAF, PCI-DSS, ISO 27001, PDPO, NIST, MITRE ATT&CK, OWASP, Protection of Critical Infrastructures (Computer Systems) Bill or other security risk management framework or regulatory requirements is an advantage
• Independent, strong self-initiative and with passion in cyber security professional.
• Good command of written and spoken English with Mandarin is preferable and
• Good communication and interpersonal skills.
• Candidate with less experience or qualification will also be considered as Assistant Technology Risk Manager

More Job Information

Job Function

• 銀行 · 金融服務 - 一般 · 其他

Employment Term

• 全職

Education

• 學士