Cybersecurity Manager
Summary
Cybersecurity Manager at the AFRC, Hong Kong's independent accounting regulator: performs security risk assessments on IT systems, sets infrastructure and cloud hardening standards, strengthens privileged access and third-party management, and leads deployment of security tools (PAM, ZTNA, EDR, DLP, WAF) across Microsoft 365 and Azure. Renewable contract role.
About Us
The Accounting and Financial Reporting Council (AFRC) is the independent regulator of the accounting profession in Hong Kong established under the AFRC Ordinance (Cap. 588). As an independent regulator, we spearhead and lead the accounting profession to constantly raise the level of quality of professional accountants, and thus protect the public interest. This pivotal role not only enhances the quality of financial reporting but in turn reinforces our pursuit of promoting the healthy development of the profession and Hong Kong’s position as a competitive international financial centre.
Responsibilities
Perform security risk assessments on IT systems to identify security weaknesses and non-compliance with the IT Reference Architecture and IT Security Control Matrix.
Develop and recommend solutions to mitigate identified security risks.
Develop and maintain infrastructure hardening standards, including standards for cloud platforms.
Strengthen privileged account management and third-party support management processes.
Lead the implementation of security tools and solutions to enhance the overall infrastructure security posture.
Ensure smooth IT operations and implement automation to improve operational efficiency and team productivity.
Fulfil other responsibilities as assigned.
Requirements
Bachelor’s degree in Cybersecurity, Information Systems, Computer Science or related discipline.
Holder of a recognised professional cybersecurity certification, such as CISA, CISM, CISSP, CEH or OSCP.
Possession of at least one cloud security certification such as CCSP, AWS Certified Security Specialty, or a relevant Microsoft Azure security certification.
At least 5 years of relevant experience in IT security or cybersecurity.
Hands-on experience and strong knowledge of IT infrastructure and networking.
Hands-on experience in security assessment and implementation for Microsoft 365 and Microsoft Azure cloud platforms.
Hands-on experience with security tools and solutions, such as PAM, ZTNA, email security, EDR, DLP and WAF.
Strong knowledge of IT general controls, cybersecurity risks, and technology risks including infrastructure, cloud and application security.
Familiar with vulnerability management and cyber hygiene principles, as well as network and web application security testing methodologies and techniques.
Strong analytical and problem-solving skills, with excellent communication and interpersonal skills and the ability to work effectively as part of a team. Project Management experience is beneficial.
Good command of both written and spoken English and Chinese, including Cantonese and Mandarin.
This is a renewable contract role. A competitive package will be offered to the successful candidate.
To submit your application, please click Quick Apply.
Data held by the AFRC relating to employment applications will be kept confidential and used for recruitment purposes only. Applicants who are not contacted within six weeks may consider their applications unsuccessful. The AFRC will retain their applications for a maximum of one year.