Information Security Expert C

Job Description

KEY RESPONSIBILITIES

2.1 COMPLIANCE & RISK MANAGEMENT (~40%)

• Independently own the company’s information security governance program: develop the annual security and compliance roadmap, delivery plan, and resource requests - and be accountable for
  outcomes
• Lead the build-out, operation, internal audit, and external certification of an ISO/IEC 27001 ISMS, driving non-conformity remediation to closure
• Own China’s Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification, registration, gap assessment, and remediation
• Operationalize obligations under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL): data classification and grading, PIAs, and cross-border transfer compliance
• Establish the risk assessment methodology; lead annual risk assessments, ad-hoc assessments, and third-party / supply chain security reviews
• Maintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forums
• Interface with regulators, customer security audits, and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation quality
• Provide compliance advisory and security review to business, product, and engineering teams, embedding security requirements upstream into processes
• Drive policy rollout and compliance training; track departmental progress and tie results into performance evaluation

2.2 ENABLEMENT & SECURITY CULTURE (~25%)

• Build a tiered security training program: compliance and awareness training for all staff, secure development training for engineers, and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curricula
• Conduct security awareness campaigns (phishing simulations, security awareness week, case briefings) with measurable effectiveness evaluation and continuous improvement
• Author and maintain company-level policies, technical standards, and security baselines; own rollout, Q&A, and adoption checks
• Establish durable culture mechanisms: departmental security liaisons / security champions, security performance indicators, positive incentives, and violation reporting
• Deliver presentations and training to varied audiences (executives, engineers, all staff), translating professional requirements into clear language and executable actions
• Track global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets

2.3 SECURITY ARCHITECTURE & ENGINEERING (~15%)

• Contribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to delivery
• Lead or drive implementation of key controls: IAM / SSO, account and privilege governance, data encryption and masking, key management, endpoint and cloud security baselines
• Conduct security reviews of major initiatives (cloud migration, core system re-architecture, new business launches); produce risk findings and remediation requirements, and follow through to resolution
• Participate in security product selection and PoC validation; author company-level security baselines and technical specifications

2.4 PENETRATION TESTING & RED TEAMING (~10%)

• Own authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan, manage external vendors, and control delivery quality
• Review test plans, execution, and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testing
• Conduct secure code reviews and software composition analysis (SCA); follow through on vulnerability remediation
• Organize red team / purple team exercises and convert results into defensive improvements and training material

2.5 DETECTION & INCIDENT RESPONSE (~10%)

• Drive detection capability: specify detection scenario requirements, follow through on rule implementation and false-positive suppression, and raise discovery rates for adversarial behavior
• Establish and maintain alert severity classification, incident handling SOPs, and emergency response plans; conduct regular drills and post-incident reviews
• Participate in triage, coordination, and root-cause review of major security incidents; deliver incident reports and drive remediation
• Drive full-lifecycle vulnerability management and remediation tracking; coordinate with the operations team and enforce remediation SLAs

Qualifications

3.1 BASIC REQUIREMENTS

• Bachelor’s degree or above; Information Security, Computer Science, Network Engineering, or Information Management preferred
• 4+ years of information security experience, including 3+ years independently owning security governance, compliance, risk, or a security program
• An IT background: substantive work or project experience in networking, systems operations, software development, or cloud; able to review technical designs and engage effectively with engineering
• Has led the build-out of an ISO 27001 / MLPS / data compliance program and taken it through external audit or regulatory inspection to full closure

3.2 TECHNICAL BACKGROUND & HANDS-ON CAPABILITY

This role is governance-led and does not carry a heavy offensive workload - however, it requires genuine technical grounding: understand it, verify it, hold the line. Engineering teams must not be able to explain away deficiencies.

1. IT Fundamentals: Understand the TCP/IP stack and common network architectures; familiar with Linux and Windows security mechanisms and hardening essentials for common middleware and databases
2. Technical Comprehension: Grasp Zero Trust, IAM/SSO, data encryption and masking, key management, and cloud-native / container security principles and control objectives; able to review whether a technical design satisfies compliance and security requirements
3. Vulnerability & Attack Knowledge: Familiar with OWASP Top 10, MITRE ATT&CK, and common vulnerability mechanics; able to reproduce and verify common vulnerabilities and judge whether a fix effectively closes the issue (no unknown-vulnerability research expected)
4. Tooling: Able to independently use common security tools for baseline checks - vulnerability scanning, configuration baseline review, asset and port discovery, account and privilege review - and to interpret scan reports and alerts
5. Data Handling: Working Python / Shell scripting for register maintenance, data reconciliation, and automated compliance checks

3.3 GOVERNANCE & COMPLIANCE CAPABILITY

• Deep knowledge of ISO/IEC 27001, ISO/IEC 27701, MLPS 2.0, GDPR, and China’s cybersecurity and data protection legal framework; able to translate clauses into actionable controls and audit checkpoints
• Proven ability to independently lead program build-out, conduct internal audits, manage external certification, and drive non-conformity remediation
• Hands-on experience in risk assessment, data classification and grading, PIAs, and vendor security assessments
• Substantive experience independently leading regulatory inspection responses and customer security audits

3.4 ENABLEMENT & TRAINING CAPABILITY

• Has independently built an enterprise security training program or security awareness campaign
• Able to design curricula, deliver training, and conduct rollout sessions; adjusts depth and framing for different audiences (executives, engineers, all staff)
• Strong writing skills; able to independently produce policies, compliance reports, training materials, and executive-level briefings

3.5 INDUSTRY CERTIFICATIONS (KEY SCREENING CRITERION)

Candidates should hold at least one certification below. As this is a governance-led role, management-track and compliance/privacy certifications are preferred; technical certifications serve as supporting evidence.

• International - Governance: CISSP, CISM, CISA, CRISC, CCSP
• China - Compliance: CISP (CISE / CISO), CISAW, MLPS evaluator
  certification, CCRC credentials
• Privacy: IAPP CIPP/E, CIPM, CIPT, ISO 27701 qualifications
• Technical Capability: CEH, Security+, OSCP, GPEN, GWAPT
• Cloud Security: Alibaba Cloud / Tencent Cloud / Huawei Cloud security
  certifications; AWS Security Specialty, Azure Security Engineer, CCSK

3.6 SOFT SKILLS

• Operates independently: develops plans, coordinates resources, and drives results without requiring step-by-step direction
• Strong cross-functional influence: builds consensus between business velocity, engineering efficiency, and compliance red lines – and drives remediation to closure
• Communicates and trains effectively: explains risk to executives, requirements to engineers, and expected behavior to all staff
• Balances principle with pragmatism: uncompromising on red lines, flexible on implementation
• Strong documentation skills: independently produces policies, designs, reports, and training decks ready for review
• English reading ability to work with original regulations and standards is a plus

======================================================================
4. NICE TO HAVE

• ISO 27001 Lead Auditor (LA / LI) or certified internal auditor qualification
• Independent teaching, corporate trainer, or industry speaking experience
• Completed delivery of a data security governance or personal information protection compliance program
• Track record leading a major regulatory inspection or large-scale security remediation program
• First-hand experience in IT operations, development, or cloud platform delivery
• Contribution to national, industry, or group-level standards

Additional Information

By choice, we are committed to a diverse workforce and are an equal opportunity employer. Robert Bosch welcomes and encourages applications from people with disabilities. Accommodations are available on request for candidates taking part in the selection process.