# Information Security Governance Specialist **Company**: HKEX **Location**: TKO **Experience**: senior **Job type**: permanent **Category**: IT **Industry**: Finance **Apply**: https://hkex.wd3.myworkdayjobs.com/en-US/HKEXCareerPage/job/HK-TKO-5F/Assistant-Vice-President--AVP---Information-Security-Governance_R004433?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_bda2c353-c03 ## Description We are seeking an Information Security Governance Specialist to join our team. As a purpose-driven company, HKEX is committed to connecting, promoting, and progressing our markets and the communities they support for the prosperity of all. **Job Summary:** The successful candidate will be responsible for managing and maintaining enterprise security configuration standards and baselines, reviewing and adopting the latest Center for Internet Security (CIS) Benchmarks, overseeing updates to security configuration scanning tools, developing and reviewing Generic Security Baselines (GSBs), and ensuring security configuration standards remain current and effective. **Responsibilities:** - Manage and maintain enterprise security configuration standards and baselines. - Review and adopt the latest CIS Benchmarks, ensuring alignment with HKEX security requirements. - Oversee updates to security configuration scanning tools to incorporate the latest CIS Benchmarks and security checks. - Develop, review, and maintain GSBs for technologies and platforms not covered by CIS Benchmarks. - Ensure security configuration standards remain current, effective, and aligned with industry best practices and regulatory requirements. - Administer the security exception management process for security findings. - Review and validate exception requests to confirm that appropriate business justification, risk assessment, compensating controls, and management approvals are in place. - Assess and validate potential false-positive findings identified through security configuration scans. - Maintain accurate records of approved exceptions and monitor their validity periods and expiry dates. - Perform governance and approval activities to ensure security standards and operational requirements are met. - Review and approve website, file upload, and email whitelisting requests in accordance with established security policies and risk management requirements. - Review and approve encryption key management requests and related activities according to cryptographic standards and key management requirements. - Review and approve requests related to internal Certificate Authority (CA) certificates and ensure proper issuance, renewal, usage, and management of digital certificates. - Review and approve SUDO registration and privileged escalation and ensure requests are granted with least-privilege and security governance principles. - Conduct Security Acceptance Checklist (SAC) reviews and approvals as part of the SDLC process control. - Assess and approve SSR requests stating security requirements are not applicable, ensuring adequate justification and risk assessment are documented. - Review and approve requests for installation of non-standard software, with evaluation of associated operational, security, compliance, and technology risks. **Requirements:** - Minimum 10 years of relevant experience in information security governance, information security, technology risk management, compliance, or IT audit functions, preferably within financial services or a regulated environment. - Good understanding of information security governance, risk, and control concepts. - Strong understanding of CIS Benchmarks, control principles, and security governance processes. - Excellent analytical, communication, and stakeholder management skills. - Ability to analyse processes and identify gaps or improvement opportunities. - Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Technology, or related discipline. - Relevant professional certifications such as CISSP, CISM, ISO 27001 Lead Implementer/Auditor, CCSP or equivalent are preferred. ## Skills ### Required - information security governance - CIS Benchmarks - security configuration - risk management - compliance ### Nice to have - CISSP - CISM - ISO 27001 Lead Implementer/Auditor - CCSP --- Source: [Apply at hkex.wd3.myworkdayjobs.com](https://hkex.wd3.myworkdayjobs.com/en-US/HKEXCareerPage/job/HK-TKO-5F/Assistant-Vice-President--AVP---Information-Security-Governance_R004433?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)