Responsibilities:

• Assist technology risk management team to develop & manage security governance framework & risk portfolio
• Assist to establish and review policies, guidelines, procedures in technology risk management area
• Act as a subject matter expert to provide consulting & advisory services on application security
• Assist in reviewing application development projects on technology risk perspective, assist to establish and implement remediating security controls
• Provide governance and support over security tools including pentest tools, vulnerability scanning tools, source code scanning tools, WAF, FIM etc.
• Conduct or manage security assessments include vulnerability scanning, penetration testing, system hardening etc.
• Assist to develop application risk control baseline standard
• Research and evaluate latest security threats & technology
• Promote information security awareness across the corporation

 Requirements:

• Bachelor Degree graduates in Computing related disciplines
• Preferably with relevant qualifications such as CISSP, CSSLP, CISA, CRISC, CSX-F & CSX-S
• Minimum 3 years’ IT related experience with knowledge of PCI-DSS will be advantage
• Sound understanding and knowledge in information security terminology and concepts
• Good communication & interpersonal skills across different levels
• Ability to work as a good team player with minimum supervision
• Ability to handle multi-task and work well under pressure
• Occasional travel may be required

Applicants for the above positions must be proficient in spoken and written Chinese (including Mandarin) and English, and be competent in MS Office applications.

Attractive remuneration packages will be offered to suitable candidates. Interested parties please send full resume with present and expected salary to Human Resources Department, 20/F BOC Credit Card Centre, 68 Connaught Road West, H.K. (Please quote Ref. no.) OR email to us.

**Data collected would be used for recruitment purposes only.  Applicants who do not hear from us within 8 weeks may consider their application unsuccessful and their data will be destroyed within 12 months of receipt.