Technology Risk & Security Lead

Bank of China (Hong Kong); Hong Kong; On-site; HKD 450,000 - 650,000; Full time

Benefits offered by this job

Medical insurance

Life insurance

Allowances

Job summary

Bank of China (Hong Kong) is seeking a security-focused professional to support technology risk and information security programs across application, system and third-party domains. The role involves advisory work, policy review, and hands-on risk assessments, including vulnerability scanning and tests.

The ideal candidate will have 2+ years in IT security within a financial institution, and may hold HKMA framework certifications such as CISA, CISSP, or CRISC.

Qualifications

• Degree holder in Computer Science or Information Systems or related discipline.
• At least 2 years of IT security, technology risk, risk management, compliance or IT audit experience in a sizable financial institution.
• CISA, CISSP, CRISC certifications preferred under HKMA enhanced competency framework.
• Familiar with HKMA TMG-1, TM-E-1, PCI-DSS, ISO 2700-series or other security risk management framework advantageous.
• Good command of written and spoken English with Mandarin preferable; good communication and interpersonal skills.
• Willingness to travel.

Responsibilities

• Assist in reviewing IT initiatives and provide advisory from technology risk perspectives.
• Assist to establish and review policies, guidelines, procedures in application security area.
• Provide advisory and practical guidance to support technology risk and information security assessments, including vulnerability scanning and penetration tests.
• Conduct regular assessments on application security.
• Familiar with security testing tools e.g. Fortify, AppScan and Open Source Scanning tools; knowledge of DevSecOps and OWASP is preferable.
• Research and evaluate latest trends and technologies on information security and fintech such as FinTech, AI, Big Data, Cloud.
• Plan and conduct security assessment in system security, third-party security and information security domains.
• Drive security assessments of third-party vendors and manage onboarding/offboarding risk.
• Assist to establish and review policies, guidelines, procedures in system security, physical security and fintech security areas.
• Co-operate with system administrators to deploy information security controls and remediate security incidents.

Job description

Bank of China (Hong Kong) is seeking a security-focused professional to support technology risk and information security programs across application, system and third-party domains. The role involves advisory work, policy review, and hands-on risk assessments, including vulnerability scanning and tests.

The ideal candidate will have 2+ years in IT security within a financial institution, and may hold HKMA framework certifications such as CISA, CISSP, or CRISC.