VP, IT Risk & Controls — Audit-Ready Strategist

Hong Kong Exchanges and Clearing Limited (HKEX)

Hong Kong

On-site

HKD 900,000 - 1,500,000

Full time

14 days+

A complete application in a minute

Tailored resume and cover letter, ready to send.

Get past ATS filters

Job summary

Hong Kong Exchanges and Clearing Limited (HKEX) invites a senior technology risk professional to join the CTO Office and Process, Risk and Control. You will design and oversee risk-based testing, lead Line 1.5 assurance, and drive regulatory readiness across infrastructure, cybersecurity, cloud and applications.

The role requires 8–12+ years in technology risk, strong stakeholder management, and professional qualifications (CISA/CISSP/CISM).

Qualifications

Bachelor’s or master’s degree in computer science, Information Technology, Engineering, or a related discipline.
8–12+ years of experience in technology risk, IT risk assessment, information security, or control assurance, ideally within banking, financial services, or regulated environments.
Demonstrated experience operating in or alongside a Line 1.5 risk and control function, with strong understanding of first‑line technology operations.
Proven ability to engage credibly with senior technologists, auditors, and risk stakeholders.
Relevant professional qualifications (e.g., CISA, CISSP, CISM) or equivalent preferred
Strong knowledge of IT general controls, application controls, cybersecurity, cloud technologies, and SDLC (Agile/DevOps).
Ability to assess complex technical environments and translate them into clear risk and control insights.
Excellent stakeholder management, communication, and influencing skills, with the confidence to challenge constructively.
Strong judgment, independence of thought, and a solution‑oriented mindset.

Responsibilities

Design, execute, and oversee risk‑based control testing programs to validate the design and operating effectiveness of technology controls across infrastructure, cybersecurity, cloud, and application environments.
Perform independent Line 1.5 testing and thematic reviews, providing objective challenge while remaining close to BAU technology operations.
Ensure testing approaches align with internal control frameworks, regulatory expectations, and audit standards.
Act as the technology audit readiness lead, reviewing evidence quality, control narratives, and documentation to ensure defensibility for auditors, and regulators.
Proactively simulate audit and regulatory inquiries, identifying potential gaps before formal reviews.
Coordinate technology responses to audit observations, regulatory reviews, and management actions.
Lead and facilitate IT critical processes and controls development, guiding teams in identifying key risks, assessing inherent and residual risk, and defining effective control measures.
Challenge risk ratings, control design, and assumptions to ensure consistency, accuracy, and completeness.
Drive alignment between assessment outputs, control testing results, incidents, and audit findings.
Provide oversight of technology incidents, control breaches, and audit issues, ensuring timely root cause analysis and sustainable remediation.
Track and challenge remediation plans arising from audits, incidents, and risk assessments to ensure closure quality and effectiveness, not just completion.
Identify systemic issues and recurring themes, escalating material risks to senior management where appropriate.
Develop and maintain meaningful KRIs and KPIs to monitor technology risk exposure, control health, and remediation progress.
Deliver concise, insightful reporting and presentations to technology risk management committee.