Manager / AVP, Cyber Security Management

PRINCIPAL ACCOUNTABILITIES:

Cyber Security and IT Governance Cluster is the first line of defense Control Function to ensure that effective cybersecurity controls are in place in addressing the emerging cyber threats. The Cluster consists of Cyber Security Management (CSM), IT Policy and Compliance (ITPC) and Parameter and User Access Management (PUAM). Its function includes but not limited to the establishment and management of the cybersecurity organization, policies framework development, controls architecture, cybersecurity incident management, cybersecurity awareness, third party security, collaboration with external interested parties, cyber threats intelligence, cybersecurity and IT compliance monitoring, audit and compliance assessment coordination, issues remediation management, and parameter and user access management.

This role is positioned under the Cyber Security Management (CSM) under the cluster, with the following responsibilities:

• Responsible for the design, implementation, operation, improvement, and reporting of the cybersecurity management system/program based on internationally recognized standards such as ISO/IEC 27001.

• Responsible for establishing the cybersecurity management governance model and defining key cybersecurity roles and responsibilities.

• Supports the establishment and maintenance of cybersecurity objectives, strategy, and program.

• Responsible for developing and maintaining cybersecurity policies, procedures, standards, and guidelines.

• Monitors and evaluates the effectiveness of cybersecurity controls.

• Acts as an engagement point for the Cyber Security Management Team with external stakeholders to provide cybersecurity expertise.

• Responsible for establishing and maintaining the cybersecurity awareness program.

• Supports the maintenance of ISO/IEC 27001 certification.

• Participates in the regional cybersecurity assessment team, collaborating with onshore teams to conduct regular cybersecurity inspections for institutions in Macao, Taiwan, Japan, South Korea, and Vietnam, and provides guidance on issue remediation.

• Performs any other duties as assigned by the Head of Cyber Security and IT Governance.
  

INCUMBENT REQUIREMENT:

• Degree holder in Cyber Security / Computer Science / Information Technology or related discipline;

• Minimum 5 years or above of relevant experience in Cyber Security Management / Cyber Security Operations / Technology Risk Management or IT Audit, preferably with experience gained from consultancy / banking / finance industry; appropriate candidate with abundant experience may be considered as the team leader;

• Experience in sound Threat Intelligence Management (e.g. threat modelling, threat hunting, threat intelligence analysis) would be definitely an advantage;

• Experience in sound Security Incident Management and simulation drill would be definitely an advantage;

• Sound technical knowledge of Application Security (DevSecOps, SSDLC, Application Security Testing) would be definitely an advantage;

• Holder of HKMA ECF-C recognized certifications at professional level is required;

• Customer-oriented, good communication and interpersonal skills;

• Able to work independently and under pressure with tight deadline;

• Strong problem-solving, analytical skills and presentation skills;

• Good command of written and spoken Mandarin is a must;

• Proficiency in preparing management dashboard / reporting deck and reports in Chinese is definitely an advantage;

• Excellent communication, interpersonal, and problem-solving skills.

• Experience in cross-border compliance reviews or audits is highly advantageous.

Candidate with more experience will be considered for a senior position.

Applicants who are not contacted within 8 weeks may consider their applications unsuccessful and their personal data will be retained by the bank for a period up to two years.

All information provided by applicants will be used for recruitment purposes only and will be used strictly in accordance with the bank’s personal data policies, a copy of which will be provided upon request.