Position Description

The Deputy Head of Information Security will be based in Hong Kong and report directly to the Head of Information Security. The role is responsible for leading and managing cybersecurity and data security governance, risk management, compliance, security operations, and strategic security initiatives across CSI. The successful candidate will play a key leadership role in protecting the organization's information assets, ensuring regulatory compliance, and strengthening cyber resilience while enabling business growth and innovation.

Key Areas of Responsibilities

Governance, Strategy and Risk Management

1. Lead the development, maintenance, and continuous enhancement of CSI's cybersecurity and data security strategies, frameworks, policies, standards, and procedures.
2. Establish, implement, and enforce an enterprise-wide governance framework covering data management, data lifecycle management, data protection, and data loss prevention.
3. Identify, assess, prioritize, and report cybersecurity and data security risks, and drive effective risk mitigation strategies.
4. Provide regular cybersecurity risk, governance, and compliance reporting to senior management and relevant governance committees.
5. Establish and maintain cloud security governance frameworks supporting CSI's multi-cloud strategy across AWS, Azure, and Alibaba Cloud.

Regulatory Compliance and Audit

1. Ensure CSI's infrastructure, systems, and applications comply with applicable laws, regulations, and industry standards, including ISO 27001, NIST, GDPR, PDPO, PIPL, MAS, and other relevant regulatory requirements.
2. Maintain audit readiness and coordinate responses to regulatory examinations, compliance assessments, internal and external audits, client security questionnaires, and due diligence reviews.
3. Act as a key security liaison with regulators, auditors, compliance teams, and external stakeholders.

Security Operations and Cyber Resilience

1. Oversee Security Operations Centre (SOC) activities, threat monitoring, incident management, and Level 2 support for security technologies.
2. Govern CSI's vulnerability management program in collaboration with Application, Platform, and Infrastructure teams.

Security Architecture and Technology Oversight

1. Provide security oversight for enterprise architecture, cloud adoption, application security, infrastructure security, and technology transformation initiatives.
2. Ensure security controls and monitoring capabilities are appropriately designed and implemented across on-premises and cloud environments.
3. Evaluate emerging technologies and cybersecurity threats, providing recommendations to strengthen CSI's security posture.

Third-Party Risk Management

1. Oversee third-party cybersecurity risk management processes and security assessments for vendors, service providers, and outsourcing arrangements.
2. Ensure appropriate security controls and contractual requirements are embedded in third-party engagements.

Security Awareness and Stakeholder Management

1. Oversee enterprise-wide security awareness, education, and training programs to strengthen the organization's security culture.
2. Build strong relationships with business, technology, risk, compliance, legal, and operational stakeholders.
3. Drive cross-functional initiatives to deliver secure, resilient, and compliant technology services.

Leadership and Team Management

1. Support the Head of Information Security in developing and executing the overall security strategy and roadmap.
2. Mentor, coach, and develop cybersecurity professionals and foster a high-performance security culture.
3. Manage the information security project portfolio and ensure effective delivery of cybersecurity initiatives.
4. Lead cybersecurity incident response, investigation, recovery, and lessons-learned activities.
5. Ensure cyber resilience, disaster recovery, and business continuity capabilities are established, maintained, and regularly tested.
6. Lead and coordinate cybersecurity tabletop exercises and crisis simulation exercises.

Requirements

1. Bachelor’s degree or above in computer science, engineering or related domain discipline
2. Minimum 15 years of relevant experience in IT, cyber, and data security
3. Deep understanding of / Demonstrating familiarity with Cyber Security topics – Firewalls, WAF, Application security, Cloud security, web gateway, endpoint protection, SIEM, threat hunting, identity access management, application whitelisting, O365, data leakage protection, network security, email security, etc.
4. Strong interpersonal, organizational and problem-solving skills as well as project management, client serving, multi-tasking
5. Able to work independently, attention to details, result-driven
6. Enthusiastic, self-motivated with proactive mindset
7. Strong leadership skills and people management skills
8. Able to drive projects involving multiple teams and knowledge domains
9. Excellent command of / fluent in both reading, speaking and writing (English and Chinese (Putonghua is a must))
10. Certification – required — CISSP, or CISM/CIS/ ISO 27001 Lead Implementer/ Auditor