Cybersecurity & Infrastructure Support Specialist

To strengthen WVHK’s cybersecurity posture and support the secure, stable and compliant operation of its IT infrastructure and core technology services. The role will help maintain effective security controls, infrastructure availability and operational readiness, ensuring the reliable operation of WVHK’s PCI DSS-compliant environment and supporting its business continuity and disaster recovery requirements.

• Work closely with the IT Infrastructure Architect, the Cybersecurity & Infrastructure Support Specialist will plan, implement, and maintain and improve WVHK’s network and security infrastructures, and will be responsible for designing, enforcing, and continuously improving network and cybersecurity policies, standards, and controls.

• Oversee the operation network and security technologies, including firewalls, endpoint protection, and intrusion prevention systems, and will conduct and coordinate penetration tests, vulnerability scans, risk assessments, and remediation activities.

• Monitor network performance and security events, managing incident response, and leading investigations of security breaches, as well as ensuring compliance with relevant cybersecurity frameworks, regulatory requirements, and WVHK policies.

• Carry out IT security projects to ensure timely, high-quality delivery; stay abreast of emerging cyber threats and technologies; and proactively recommend improvements.

• Support end-to-end compliance activities, including the design and implementation of security controls, evidence collection, and coordination of the annual PCI DSS audit.

• Support the implementation, maintenance and regular testing of BCP and DR arrangements, including backup and disaster recovery processes, in line with compliance and data-retention requirements.

• Perform any other duties as assigned by the superior

KEY REQUIREMENTS

Education

· Bachelor’s degree or above in Information Technology, Computer Science, Cybersecurity, or related disciplines.

· Hold relevant cyber security certifications is an advantage.

Experience

· 8 years of relevant IT experience is preferred, of which 5 years are in network and/or information security.

· Strong proficiency in both written and spoken English and Chinese, with excellent communication and interpersonal skills

· Experience in the NGO sector and/or large-scale international organizations will be an advantage

Hands-on experience or working knowledge in:

· Enterprise network and security technologies, including Firewall, EDR/XDR/NDR, WAF/DBF, SIEM, ZTA, PAM, IAM, SSO, DLP, IDP/IPS, DDoS protection, MDM, Wi‑Fi, and network monitoring tools

· Cloud and hybrid environments, including security controls, network integration, and identity management in platforms such as Microsoft Azure, M365, EntraID, Intune, AWS, VMware, Zscaler, Cloudflare or equivalent

· Network and system management tools such as PRTG, etc

· Data classification and security measures, with a good understanding of compliance requirements such as the Hong Kong PDPO and/or GDPR

· Penetration testing, vulnerability assessment, security audits and cybersecurity frameworks is an advantage

· Self‑motivated, detail‑oriented, and able to manage multiple projects, with strong organizational skills

Please apply with your full resume, listing church affiliations (if any), current and expected salary to https://services.worldvision.org.hk/jobapplication or by clicking "Apply Now"

To find out more about our job opportunities, please visit our website
https://www.worldvision.org.hk/get-involved/vacancies 

World Vision Hong Kong is committed to safeguarding our children and adult beneficiaries from any risk of abuse, exploitation and harm. Candidates selected for interviews will be requested a self-declaration of previous records for any crimes against children or sexual offences, and may be requested to undergo Sexual Conviction Record Check by the HK Police.

Personal Data provided by job applicants will be used for recruitment purposes only and will be treated in accordance with the organization's personal data privacy policy. Applicants who are not invited for interviews within six weeks may consider their applications unsuccessful and the personal data collected will be destroyed within 12 months.