# Cyber Risk Manager

**Company**: HKEX
**Location**: HK-ONE ES 24/F
**Experience**: senior
**Job type**: full-time
**Category**: Security
**Industry**: Finance

**Apply**: https://hkex.wd3.myworkdayjobs.com/en-US/HKEXCareerPage/job/HK-ONE-ES-24F/AVP-VP---Cyber-Risk--Operational-Risk---Resilience_R004549?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/jobs/job_f69d90bf-ab8

## Description

We are seeking a Cyber Risk Manager to provide independent second-line oversight, advice, and constructive challenge over the Group's management of cyber, AI, and data risks.

The successful candidate will lead cyber, data, and AI risk assessments, second-line external red team testing and cyber drills/tabletop exercises, provide emerging-risk analysis, and report material risks to senior management and governance committees.

Key responsibilities include:

- Identifying, assessing, and monitoring material cyber, data, and AI risks; providing independent advice and constructive challenge to ITD and other first-line owners, and escalating significant exposures with recommendations for mitigation and remediation.

- Monitoring, developing, and reporting key cyber risk and performance indicators, escalating trends, and providing risk insights where appropriate.

- Coordinating and overseeing risk-based external threat-led red-team and adversarial security testing; challenging scope, scenarios, coverage, independence, findings, and residual risk.

- Assessing and challenging ITD's defence-in-depth approach across identity, network, endpoint, application, data, cloud, third-party, and recovery controls.

- Developing and coordinating cyber tabletop and crisis-simulation activities that test decision-making, escalation, regulatory notification, communications, recovery, and dependencies.

- Providing independent insight supporting responsible AI governance, assessing cybersecurity, data, model, third-party, human-oversight, and resilience risks, and monitoring emerging AI-enabled threats.

- Supporting the Group's data governance and data risk management journey by advising on data confidentiality, integrity, availability, classification, access, lineage, quality, retention, sharing, and resilience.

Requirements:

- A self-motivated, reliable, collaborative, and proactive individual with strong influencing skills and excellent written and verbal communication abilities.

- At least 7 years (AVP) or 10 years (VP) of relevant experience in cyber security and related fields, preferably within the financial services sector or in professional services supporting financial services clients.

- Strong organisational and programme leadership skills, with the ability to prioritise, manage multiple significant assignments, and deliver high-quality outcomes with limited supervision.

- Strong stakeholder management skills and the confidence and credibility to provide constructive challenge, manage differing perspectives, and achieve appropriate risk outcomes.

- Strong practical knowledge of cyber risk governance, security architecture, defence-in-depth, red-team testing, penetration testing, cyber resilience, and crisis exercises.

- Professional certifications such as CISA, CISSP, CRISC, CISM, or other relevant technology risk, cybersecurity, or audit qualifications are preferred.

## Skills

### Required
- cyber risk management
- data governance
- AI governance
- security architecture
- defence-in-depth
- red-team testing
- penetration testing
- cyber resilience

### Nice to have
- CISA
- CISSP
- CRISC
- CISM
- Chinese
- Putonghua

---

Source: [Apply at hkex.wd3.myworkdayjobs.com](https://hkex.wd3.myworkdayjobs.com/en-US/HKEXCareerPage/job/HK-ONE-ES-24F/AVP-VP---Cyber-Risk--Operational-Risk---Resilience_R004549?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)