Technology Risk Manager (Information Security Control Division)

Bank of China (Hong Kong); Hong Kong; On-site; HKD 450,000 - 650,000; Full time

Benefits offered by this job

Medical insurance

Life insurance

Allowances

Job summary

Bank of China (Hong Kong) is seeking a security-focused professional to support technology risk and information security programs across application, system and third-party domains. The role involves advisory work, policy review, and hands-on risk assessments, including vulnerability scanning and tests.

The ideal candidate will have 2+ years in IT security within a financial institution, and may hold HKMA framework certifications such as CISA, CISSP, or CRISC.

Qualifications

• Degree holder in Computer Science or Information Systems or related discipline.
• At least 2 years of IT security, technology risk, risk management, compliance or IT audit experience in a sizable financial institution.
• CISA, CISSP, CRISC certifications preferred under HKMA enhanced competency framework.
• Familiar with HKMA TMG-1, TM-E-1, PCI-DSS, ISO 2700-series or other security risk management framework advantageous.
• Good command of written and spoken English with Mandarin preferable; good communication and interpersonal skills.
• Willingness to travel.

Responsibilities

• Assist in reviewing IT initiatives and provide advisory from technology risk perspectives.
• Assist to establish and review policies, guidelines, procedures in application security area.
• Provide advisory and practical guidance to support technology risk and information security assessments, including vulnerability scanning and penetration tests.
• Conduct regular assessments on application security.
• Familiar with security testing tools e.g. Fortify, AppScan and Open Source Scanning tools; knowledge of DevSecOps and OWASP is preferable.
• Research and evaluate latest trends and technologies on information security and fintech such as FinTech, AI, Big Data, Cloud.
• Plan and conduct security assessment in system security, third-party security and information security domains.
• Drive security assessments of third-party vendors and manage onboarding/offboarding risk.
• Assist to establish and review policies, guidelines, procedures in system security, physical security and fintech security areas.
• Co-operate with system administrators to deploy information security controls and remediate security incidents.

Job description

Responsibilities

• Assist in reviewing IT initiatives and provide advisory from technology risk perspectives
• Assist to establish and review policies, guidelines, procedures in application security area
• Provide advisory and practical guidance to support technology risk and information security assessments, include vulnerability scanning, penetration test etc.
• Conduct regular assessment on application security
• Familiar with security testing tools e.g. Fortify, AppScan and Open Source Scanning tools, technologies on DevSecOps and industry good practice OWASP is preferable

Roles and Responsibilities & Specific Requirements (Application Security):

• Assist in reviewing IT initiatives and provide advisory from technology risk perspectives
• Assist to establish and review policies, guidelines, procedures in application security area
• Provide advisory and practical guidance to support technology risk and information security assessments, include vulnerability scanning, penetration test etc.
• Conduct regular assessment on application security
• Familiar with security testing tools e.g. Fortify, AppScan and Open Source Scanning tools, technologies on DevSecOps and industry good practice OWASP is preferable

Roles and Responsibilities & Specific Requirements (System Security):

• Research and evaluate latest trend & technologies on information security and fintech area, such as FinTech, Artificial Intelligence, Big Data, Cloud Computing etc.
• Conduct regular assessment on OS platform security & middleware software security
• Plan and conduct security assessment in area of physical security (e.g.: data center security)
• Assist to establish and review policies, guidelines, procedures in system security、physical security and fintech technology security area
• Familiar with system platform operation and system architecture design is preferable

Roles and Responsibilities & Specific Requirements (Third-Party Security):

• Drive security assessments of third-party vendor focusing on compliance with regulations, company policies, and internal controls.
• Oversee information security risk management processes for onboarding and off-boarding of third-party vendor relationships.
• Communicate to business units and cross-functional teams regarding third-party vendor risk issues and/or control gaps, and recommends remediation initiatives.
• Provide awareness by conducting training on third-party vendor risk management framework.
• Contribute to internal practice development initiatives and technology risk knowledge base
• Stay informed about latest developments in third-party vendor risk management field.

Roles and Responsibilities & Specific Requirements (Information Security):

• Assist senior manager to formulate and manage information security policies, standards and procedures.
• Plan and conduct information security assessment and IT risk evaluation in area covering IT general controls, information asset management, access controls and endpoint security review, etc.
• Plan and carry out various information security assurance activities, such as computer accounts re-certification.
• Review the initiation of security configuration changes, such as access rules, data leakage prevention policies.
• Co-operates with system administrators to deploy various information security controls or tools, and take lead to conduct appropriate remedial action on security incidents.
• Act as a subject matter expert to assist business units and cross-functional teams in identifying and mitigating information security risks and/or control gaps, and recommends remediation initiatives.

General Job Requirements:

• Degree holder in Computer Science or other degree majoring in Information Systems, or related discipline.
• 2 years of experience in IT security, technology risk, risk management, compliance or IT audit function, gained from other sizable financial institutions
• Holding at least one recognized professional qualification under HKMA enhanced competency framework such as CISA, CISSP, CRISC is preferable.
• Familiar with HKMA TMG-1, TM-E-1, PCI-DSS, ISO 2700-series or other security risk management framework is an advantage
• Good command of written and spoken English with Mandarin is preferable and
• Good communication and interpersonal skills;
• Flexibility in traveling.
• Candidate with less experience will be considered as Assistant Manager.

We offer competitive remuneration package and comprehensive fringe benefits including medical and life insurance, and different types of allowances to the right candidates. Data collected would be used for recruitment purposes only. Applicants who do not hear from us within 8 weeks may consider their application unsuccessful and their data will be destroyed within 12 months of receipt.