IT Cyber Security Manager (Vulnerability Management)

Responsibilities:

• Lead our continuous vulnerability management programs

• Responsible for the end-to-end lifecycle of vulnerability management, including scanning, assessment, prioritisation, and coordination with IT teams for remediation, and continuous improvement of security

• Design, administer and optimise a comprehensive vulnerability scanning program, including credentialed/non-credentialed scans, agent-based scans, internal and external vulnerability scans.

• Manage a robust vulnerability and threat exposure management and prioritisation framework that goes beyond CVSS score, incorporating a range of factors such as distance from exposure, asset criticality, exploit availability, and data sensitivity, etc.

• Stay current with emerging threats, CVEs and industry best practices to proactively adjust scan policies and prioritisation framework.

• Participate in system integration developments and administer, support and troubleshoot cybersecurity systems.

• Develop, maintain and fine-tune system operating procedures, including back-up & disaster recovery, vulnerability, update & patch management, system maintenance and monitoring and audit.

• Work closely with technical vendors and internal stakeholders to ensure compliance requirements are addressed and security solutions are implemented effectively.

• Coordinate and collaborate closely with IT and business users to ensure successful enablement of cybersecurity solutions.

• Stay up-to-date with emerging trends and technologies in IT security and make recommendations for their adoptions.

Requirements:

• Bachelor’s or above degree in Computer Science, Information Security, Engineering or related field.

• 7+ years of experience in IT security, with a specialised focus on vulnerability management and threat exposure management.

• Proven track record of management vulnerability management program in complex, hybrid environments (on-premise, cloud and containerised).

• Deep proficiency in interpreting CVEs, CVSS scores, and exploit databases to assess risk.

• Proven experience with patch management tools and IT service management platforms for ticketing and workflow automations.

• Strong understanding on DevSecOps practices.

• Strong understanding of computer systems, including operating systems, databases, network, infrastructure, containerised environment and cloud computing.

• Scripting skills for automation is advantageous.

• Cybersecurity certificates such as CISSP, CISP, or CISA, are highly preferred.

• In-depth knowledge of IT security frameworks and standards such as ISO 27001, NIST Cybersecurity Framework, Digital Policy Office (DPO) IT Security Policy, and Cybersecurity Law of the People’s Republic of China.

• Experience in working in an international team, with solid grounding in financial service is a plus

• Fluent in English, Cantonese, and/or Mandarin

• Working location in Hong Kong