Senior IT Security Governance Specialist

Responsibilities:

Governance

• Assist AGM of IT Security Governance to strengthen the 1st line of defense to improve oversight of technology risk and support the rapid Fintech development and transformation initiatives.
• Maintain and uphold the risk governance and management framework
• Assist to develop and maintain Information Security Policy and Cyber Security associated standard and guidance documentations.
• Work with other teams to organize and plan the corresponding actions to align with HKMA’s Cybersecurity Fortification Initiative (CFI) 2.0 including but not limited to C-RAF and i-CAST.
• Assist the KRI reporting and review indicator when requested, support to provide materials for committee meetings.

Risk

• Perform risk assessment (RCSA) to ensure oversight of technology risk across domains of IT infra and security expertise
• Evaluate technology deviation and liaise with ITG teams of implementation process
• Liaise external independent assessor (eg Big 4 firm) to conduct independent assessment for key projects/changes.
• Perform 3rd party risk assessment in accordance to regulatory and internal requirement.

Compliance

• Coordinate and respond to audit issues in relation to Cybersecurity to satisfy the compliance requirement.
• Manage remediation actions for HKMA C-RAF framework and associated guidance.
• Coordinate inspections and examinations by the regulators, internal audit and external audits; handle information request and follow up IT related recommendations.
• Perform security assurance monitoring and testing to ensure key controls remain compliant to regulatory requirement and bank standard.
• Ad-hoc task or project assigned by management related to IT Security.

Requirements:

• Degree holder in Information Technology or relevant discipline.
• 3-5 years’ experience in IT Audit and/or Information Security/Technology Risk Management
• Obtained Core / Professional level qualification of Relevant Practitioner under HKMA ECF on Cybersecurity
• Certified in CISSP, CISA, CISM or other recognized certificate is a must
• Certification in CEH, GIAC, CCNP would be an added advantage
• Has experience in TRM or IT Audit or Information Security Management
• Knowledgeable to risk management practices in IT Infrastructure, IT Application and Service Management
• Good at issue reporting/presentation and stakeholder management
• Have good understanding of the regulatory requirements such as HKMA (TM-E-1, TM-G-1, TM-G-2, SA-2), MAS, CBRC, FFIEC and etc. Possess knowledge of overseas banking regulatory requirements, particularly in Singapore, China, Macau and US is an advantage
• Familiar with industry compliance requirements such as PCI-DSS and SWIFT CSP
• Good understanding of industry best practices e.g. ISO27001, COBIT etc

For more details about career opportunities with the Bank, please visit our website http://www.cncbinternational.com/careers/en/index.jsp. Please apply with full resume stating current and expected salaries.

Personal data collected will be used for recruitment related purposes only. Applicants not invited for interview within 6 weeks may consider their applications unsuccessful. However, applicants may be considered for other suitable positions within the Group for a period of not more than 2 years. Personal data will be destroyed at any time after 3 months.

China CITIC Bank International is committed to being an equal opportunities employer and intends to provide a work environment free of unlawful discrimination or harassment. All employment decisions will be made in a non-discriminatory manner.