Senior IT Security Governance Specialist
Responsibilities:
Governance
Assist AGM of IT Security Governance to strengthen the 1st line of defense to improve oversight of technology risk and support the rapid Fintech development and transformation initiatives.
Maintain and uphold the risk governance and management framework
Assist to develop and maintain Information Security Policy and Cyber Security associated standard and guidance documentations.
Work with other teams to organize and plan the corresponding actions to align with HKMA’s Cybersecurity Fortification Initiative (CFI) 2.0 including but not limited to C-RAF and i-CAST.
Assist the KRI reporting and review indicator when requested, support to provide materials for committee meetings.
Risk
Perform risk assessment (RCSA) to ensure oversight of technology risk across domains of IT infra and security expertise
Evaluate technology deviation and liaise with ITG teams of implementation process
Liaise external independent assessor (eg Big 4 firm) to conduct independent assessment for key projects/changes.
Perform 3rd party risk assessment in accordance to regulatory and internal requirement.
Compliance
Coordinate and respond to audit issues in relation to Cybersecurity to satisfy the compliance requirement.
Manage remediation actions for HKMA C-RAF framework and associated guidance.
Coordinate inspections and examinations by the regulators, internal audit and external audits; handle information request and follow up IT related recommendations.
Perform security assurance monitoring and testing to ensure key controls remain compliant to regulatory requirement and bank standard.
Ad-hoc task or project assigned by management related to IT Security.
Requirements:
Degree holder in Information Technology or relevant discipline.
3-5 years’ experience in IT Audit and/or Information Security/Technology Risk Management
Obtained Core / Professional level qualification of Relevant Practitioner under HKMA ECF on Cybersecurity
Certified in CISSP, CISA, CISM or other recognized certificate is a must
Certification in CEH, GIAC, CCNP would be an added advantage
Has experience in TRM or IT Audit or Information Security Management
Knowledgeable to risk management practices in IT Infrastructure, IT Application and Service Management
Good at issue reporting/presentation and stakeholder management
Have good understanding of the regulatory requirements such as HKMA (TM-E-1, TM-G-1, TM-G-2, SA-2), MAS, CBRC, FFIEC and etc. Possess knowledge of overseas banking regulatory requirements, particularly in Singapore, China, Macau and US is an advantage
Familiar with industry compliance requirements such as PCI-DSS and SWIFT CSP
Good understanding of industry best practices e.g. ISO27001, COBIT etc
For more details about career opportunities with the Bank, please visit our website http://www.cncbinternational.com/careers/en/index.jsp. Please apply with full resume stating current and expected salaries.
Personal data collected will be used for recruitment related purposes only. Applicants not invited for interview within 6 weeks may consider their applications unsuccessful. However, applicants may be considered for other suitable positions within the Group for a period of not more than 2 years. Personal data will be destroyed at any time after 3 months.
China CITIC Bank International is committed to being an equal opportunities employer and intends to provide a work environment free of unlawful discrimination or harassment. All employment decisions will be made in a non-discriminatory manner.