Information Security Professional

We are seeking an experienced Information Security professional to lead and execute information security governance, security operations, security compliance, vulnerability management, and security monitoring initiatives across our business platforms.

The successful candidate will be responsible for aligning local security practices with Group security standards, driving security governance programs, managing security tools and controls, coordinating security assessments, and supporting security incident response activities.

Key Responsibilities

1. Security Operations & SOC

• Own and maintain security monitoring processes and operational procedures.
• Coordinate SIEM and log management initiatives.
• Work with Group SOC and MSSP teams on security monitoring, alert handling, and escalation processes.
• Define log collection standards, onboarding scope, and monitoring requirements.
• Participate in threat detection and security operations improvement initiatives.

2. Security Incident Response

• Develop and maintain Security Incident Response Plans and procedures.
• Coordinate incident investigation, containment, eradication, recovery, and post-incident review activities.
• Define security incident escalation workflows and communication mechanisms.
• Organize security drills, tabletop exercises, and response testing.
• Support regulatory and compliance-related incident reporting requirements.

3. Vulnerability & Security Assessment Management

• Manage vulnerability scanning programs and security assessment activities.
• Track vulnerability remediation progress and risk mitigation activities.
• Coordinate vulnerability scanning, penetration testing, secure configuration reviews, source code reviews, application security testing, CIS benchmark, and security architecture reviews.
• Prepare risk acceptance documentation and remediation plans.

4. Identity & Access Management

• Manage privileged account governance and PAM/PIM controls with Change management team.
• Coordinate periodic access reviews and account audits.
• Maintain privileged account management standards and procedures with change management team.

5. Security Technology Management

• Manage and govern security solutions including SIEM, WAF/Anti-DDOS, IPS/IDS, Endpoint Security, PAM/PIM, Web Proxy, KMS/Certificate Services, and Security Monitoring Platforms in Tencent Cloud.
• Security product selection and evaluation, vendor management, security architecture review, security product implementation and optimization, and security product lifecycle management.

6. Security Compliance & Regulatory Requirements

• Coordinate MLPS (等保) assessments and remediation activities.
• Support internal and external audits.
• Maintain compliance with applicable security regulations and standards.
• Manage third-party security assessments and compliance reviews.
• Coordinate security-related regulatory reporting and evidence collection.

Qualification Requirements

Education

• Bachelor's degree or above in Information Security, Computer Science, Information Technology, Cyber Security, or related disciplines.

Experience

• 5+ years of Information Security experience.
• Experience in security governance and compliance programs.
• Experience with SOC/SIEM operations and log management.
• Experience managing security projects and vendors.
• Experience working with regional or Group security organizations is highly preferred.
• Financial services or regulated industry experience is highly desirable.

Technical Skills

• Hands-on experience in several of the following areas: Security Operations Center (SOC), SIEM Platforms (Splunk, ArcSight, 日志易, etc.), Vulnerability Management (Tenable), Penetration Testing Coordination, Security Incident Response, PAM / PIM Solutions (CyberArk/RenkEZ), Windows / Linux Security (CIS benchmark), Network Security, Cloud Security, Security Compliance Frameworks.

Preferred Certifications

• One or more of the following: CISSP, CISM, CISA, ISO27001 Lead Implementer/ISO27001 Lead Auditor, Security+.

Soft Skills

• Strong stakeholder management skills.
• Strong communication and presentation skills.
• Ability to coordinate across multiple teams and vendors.
• Strong analytical and problem-solving skills.
• Risk-based decision-making mindset.
• Ability to work independently with minimal supervision.