VP, IT Risk & Controls — Drive Audit-Ready Tech

Hong Kong Exchanges and Clearing Limited (HKEX); Hong Kong; On-site; HKD 900,000 - 1,500,000; Full time

Job summary

HKEX CTO Office and Process, Risk and Control oversees risk-based testing and validation of technology controls across infrastructure, cloud, and applications. You will lead audit readiness, coordinate regulatory responses, and drive continuous improvement in IT risk and control practices.

You will engage senior technologists and auditors, manage remediation plans, and report KRIs/KPIs to senior management, contributing to the resilience of HKEX's technology environment.

Qualifications

• Bachelor's or master's degree in computer science, IT, engineering, or related field.
• 8–12+ years' experience in technology risk, IT risk assessment, information security, or control assurance.
• Experience operating in Line 1.5 risk and control functions and engaging senior stakeholders.
• Relevant professional qualifications (CISA, CISSP, CISM) or equivalent preferred.

Responsibilities

• Design, validate, and oversee risk-based testing programs for technology controls across infrastructure, cloud, and applications.
• Serve as technology audit readiness lead and coordinate responses to audit observations and regulator inquiries.
• Lead IT risk and control self-assessment, ensuring alignment with risk profiles and incident data.
• Oversee remediation of incidents and control breaches with timely, sustainable actions.

Skills

Tech risk

IT risk assessment

Information security

Stakeholder management

Auditors liaison

DevOps/Agile

Strong communication

Independent judgment

Education

Bachelor's or Master's degree in computer science, IT, engineering or related

Tools

CISA

CISSP

CISM

Job description

HKEX CTO Office and Process, Risk and Control oversees risk-based testing and validation of technology controls across infrastructure, cloud, and applications. You will lead audit readiness, coordinate regulatory responses, and drive continuous improvement in IT risk and control practices.

You will engage senior technologists and auditors, manage remediation plans, and report KRIs/KPIs to senior management, contributing to the resilience of HKEX's technology environment.