Job Position
Specialist I (Information Security)
Major Responsibilities
- Manage user identity and access controls, including provisioning, deprovisioning, and lifecycle management for standard and privileged accounts.
- Assist supervisors in working with the Security Operations Centre (SOC) to monitor, triage, and investigate security alerts, and coordinate incident response activities to contain and remediate threats.
- Contribute to cyber threat intelligence gathering and analysis, leveraging SOC data to proactively identify emerging threats and strengthen defensive postures.
- Administer cryptographic key and digital certificate lifecycle management, ensuring secure issuance, rotation, and revocation in line with organizational policies.
- Execute regular vulnerability assessments and automated scanning across endpoints, servers, and network infrastructure; prioritize findings and track remediation progress.
- Coordinate and contribute internal and external penetration testing for networks, applications, and cloud environments, including scoping, vendor management, and validation of fixes.
- Contribute to or provide feedback on the security controls for new systems and major projects; monitor implementation to ensure alignment with security standards and risk management frameworks.
- Assess open-source software and freeware for security risks, licensing compliance, and provide actionable recommendations for safe adoption.
- Develop automated scripts and tools to enhance security operational efficiency.
- Perform other job duties as assigned by the supervisors.
Requirements
- University degree preferably in information technology, information security or related discipline
- Minimum 4 years of experience in information security or related field
- Knowledge in security practices and standards commonly adopted by the banking/financial industry such as the Cyber Resilience Assessment Framework (C-RAF), SWIFT Customer Security Controls Framework (CSCF), ISO27001 standard, etc. is an advantage;
- Holder of security certificates - CISA, CISM, or other equivalent certificates is an advantage
- Team player with sound interpersonal, communication and presentation skills as well as excellent problem solving and analytical skills;
- Experience and knowledge in the area of public and/or private cloud security is an advantage
- Practical experience and knowledge in risk management framework and methodology is desirable
- Experience in working for major financial institutions is preferred but not a must
- Good command of written and spoken English and Chinese
- Willing to work shift duty (evening shift normally from 12:30 to 21:30 with shift duty allowance)
- Candidate from non-financial industries will also be considered
- Candidate with less experience may be considered for appointment as Specialist II (Information Security)
Application Method
Interested parties please send your curriculum vitae stating your current and expected salaries, and the contact phone number to the Human Resources Division, Unit B, 25/F, MG Tower, 133 Hoi Bun Road, Kwun Tong, Kowloon or e-mail it to hrm@hkicl.com.hk. All applications and personal information collected will be treated in strict confidence and only be used for the purpose of recruitment and selection. The information collected will be accessed by our authorized personnel only. Those applicants not contacted by the Human Resources Division within two months from their application date should consider their applications filed for future reference which will be retained for one year for possible future job matching, and will be destroyed after the expiry of one year.