Assistant Vice President - Information Security Governance

Security Configuration

• Manage and maintain enterprise security configuration standards and baselines.

• Review and adopt the latest Center for Internet Security (CIS) Benchmarks, ensuring alignment with HKEX security requirements.

• Oversee updates to security configuration scanning tools to incorporate the latest CIS Benchmarks and security checks.

• Develop, review, and maintain Generic Security Baselines (GSBs) for technologies and platforms not covered by CIS Benchmarks.

• Ensure security configuration standards remain current, effective, and aligned with industry best practices and regulatory requirements.

Security Exception Management

• Administer the security exception management process for security findings.

• Review and validate exception requests to confirm that appropriate business justification, risk assessment, compensating controls, and management approvals are in place.

• Assess and validate potential false-positive findings identified through security configuration scans.

• Maintain accurate records of approved exceptions and monitor their validity periods and expiry dates.

Security Governance Operations and Approval

• Perform governance and approval activities to ensure security standards and operational requirements are met.

Whitelisting

• Review and approve website, file upload and email whitelisting requests in accordance with established security policies and risk management requirements.

Encryption and Key Management

• Review and approve encryption key management requests and related activities according to cryptographic standards and key management requirements.

Internal Certificate Authority (CA) Governance

• Review and approve requests related to internal Certificate Authority (CA) certificatesandensure proper issuance, renewal, usage, and management of digital certificates.

Privileged Elevation Governance

• Review and approve SUDO registration and privileged escalation and ensure requests is granted with least-privilege and security governance principles.

Security Acceptance Review

• Conduct Security Acceptance Checklist (SAC) reviews and approvals as part of the SDLC process control.

• Assess and approve SSR requests stating security requirements are not applicable, ensuring adequate justification and risk assessment are documented.

Non-Standard Software Assessment

• Review and approve requests for installation of non-standard software, with evaluation of associated operational, security, compliance, and technology risks.Ensure appropriate mitigating controls are established before approval

Job Requirement: