Education/Professional:

1. University degree or above

2. Must hold information security professional qualifications recognized by the

Hong Kong Monetary Authority (such as CISSP / CISM / CISA)

Work experience:

 Working experience in banking, IT or information security;

 2 or more years of practical experience in directly operating security
tools and setting security rules;
 Participated in writing information system security or technology risk
management in policies, procedures and standards.

The scope of work:

1. Assist superiors in drafting and maintaining information security and related

management measures;

2. Assess the information security risks of new projects, the impact on banks
and propose mitigation measures;

3. Follow up special information security cases and report progress regularly;

4. Ensure that all work complies with laws and regulations, bank risk
management policies and the codes and guidelines of relevant regulatory
agencies;

5. Regularly provide information based on the IT accident history database to

assist the wind management team in drafting comprehensive technology risk
and compliance reports, and overall assess the risk level of various IT
accidents and non-compliance situations;
6. Practices for implementing a cyber defense plan that is consistent with the
Group and complies with the requirements of the Hong Kong Monetary
Authority;

7. Responsible for daily information security operation and maintenance,

including security event monitoring, account authority management, security
vulnerability management, and other regular information security work, such
as:

i. Computer operation accounts and authorization applications for newly

recruited, transferred or resigned employees;

ii. Assist in coordinating computer user/authorization annual inspections,

including launching self-inspections, monitoring, random inspections, and
collecting reports;

iii. Handle suspicious outgoing emails blocked by "Data Loss Prevention

(DLP)" and manage the DLP exception list;

iv. Collect and identify the list of suppliers related to information security and
technological risks, and assist the first line of defense (supplier
responsible/coordinating unit) to complete the supplier self-examination
questionnaire and on-site inspection;

v. Coordinate internal or external audits of materials related to information

security;

vi. Initiate regular information security checks, such as desktop cleaning,

important client programs, use of removable storage devices, and phishing
email testing;

8. Complete other tasks assigned by superiors.