This position is under the Technology Risk and Business Continuity Management Team (TRBCM), Group Information Technology Department. The primary function of the TRBCM is to oversee and manage the IT risk profile and Business Continuity of different business units within the company.

Key Responsibilities:

• Assess IT risk and business impact of risks,
• Support strategic and ad-hoc security and risk analyses,
• Write risk papers and reports,
• Participate in the development and maintenance of the group’s strategy, framework, policies, and standard in information security and risk management,
• Verify the effectiveness of the controls implemented in various technology areas,
• Identify the technology impact by law and regulatory changes and coordinate responses,
• Monitor the implementation of IT security framework in the group,
• Assist in other information risk activities when required.

Requirements:

• University degree in IT or relevant disciplines,
• 4 – 6 years of experience inIT Security/IT Audit or Risk Management,
• Sound knowledge of international information security standards (e.g., COBIT, ISO 27001)
• Experience in Business Continuity Management
• Holder of Information (Technology) Security certification (e.g. ISC2, ISACA accreditations) would be considered a plus,
• Knowledge of securities trading business and associated laws and regulations would be considered a plus,
• Good analytical skills and sound judgment,
• Fluent in Cantonese and English (written and spoken).