Technology Risk & Security Lead

Bank of China (Hong Kong); Hong Kong; On-site; HKD 700,000 - 1,000,000; Full time

Job summary

Bank of China (Hong Kong) is seeking an experienced information security professional to support application security, system security, third-party security and overall information risk across the organization.

Responsibilities include reviewing IT initiatives, advising on policies and procedures, conducting security assessments, and guiding teams on risk controls, with emphasis on compliance with HKMA, PCI-DSS and related standards.

Qualifications

• Degree holder in Computer Science, Information Systems or related discipline.
• Over 4 years of experience in IT security, technology risk, risk management, compliance or IT audit functions in sizable financial institutions.
• Familiar with HKMA enhanced competency framework such as CISA, CISSP or CRISC is preferable.
• Good command of written and spoken English with Mandarin is preferable, and strong communication skills.
• Willingness to travel and flexibility in assignments.

Responsibilities

• Assist in reviewing IT initiatives and provide advisory from technology risk perspectives.
• Assist to establish and review policies, guidelines, procedures in application security area.
• Provide advisory and practical guidance to support technology risk and information security assessments, including vulnerability scanning and penetration testing.
• Conduct regular assessments on application security.
• Familiar with security testing tools (Fortify, AppScan, open source tools) and DevSecOps practices; adhere to OWASP guidance.
• Research and evaluate latest trends in information security and fintech technologies; assess OS platform security and middleware security.
• Plan and conduct security assessments in physical security areas (e.g., data center security).
• Assist to establish and review policies in system, physical and fintech security areas.
• Familiar with system platform operation and architectural design is preferable.
• Drive third-party security assessments for regulatory compliance and internal controls; manage onboarding/offboarding risk.
• Communicate risk issues to business units and cross-functional teams; propose remediation.
• Provide awareness training on third-party vendor risk management framework.
• Contribute to internal knowledge base and practice development; stay informed on vendor risk trends.
• Assist in information security policy formulation, risk evaluation, access controls and incident remediation.

Job description

Bank of China (Hong Kong) is seeking an experienced information security professional to support application security, system security, third-party security and overall information risk across the organization.

Responsibilities include reviewing IT initiatives, advising on policies and procedures, conducting security assessments, and guiding teams on risk controls, with emphasis on compliance with HKMA, PCI-DSS and related standards.