Tech Risk & Cybersecurity Assurance Lead

China CITIC Bank International Limited; Hong Kong; On-site; HKD 900,000 - 1,200,000; Full time

Job summary

China CITIC Bank International Limited seeks a qualified professional to provide oversight of technology and cybersecurity risk management as part of the 2LoD. The role involves challenging 1LoD controls, aligning with regulatory requirements, and driving the risk management framework across IT and business units.

The successful candidate will participate in internal/external audits, risk reporting, and regulatory exercises while promoting a strong risk culture and effective controls in a large

Qualifications

• Bachelor-level degree in Information Technology, Information Systems, Risk Management, Computer Science or related discipline.
• 5-8 years of experience in operational risk management, technology risk management or information and cybersecurity risk management.
• CISSP, CISA, CISM, CRISC or other recognized certification is required.

Responsibilities

• Provide oversight and challenge of technology risk management, cybersecurity risk management, and control effectiveness of the 2LoD.
• Respond to changing business, environment, threats, and regulatory requirements.
• Assist to design, maintain and implement the technology risk management framework with ISO27001, NIST 800 and PCI-DSS considerations.
• Identify, monitor, and report operational risk; review controls and risk assessments.
• Ensure 1LoD has appropriate controls; oversee risk assessments and risk-taking activities.

Skills

English proficiency

Chinese proficiency

Education

Degree in IT / IS / CS

Job description

China CITIC Bank International Limited seeks a qualified professional to provide oversight of technology and cybersecurity risk management as part of the 2LoD. The role involves challenging 1LoD controls, aligning with regulatory requirements, and driving the risk management framework across IT and business units.

The successful candidate will participate in internal/external audits, risk reporting, and regulatory exercises while promoting a strong risk culture and effective controls in a large