Senior IT Security Analyst (Multiple vacancies)

Key Responsibilities:

1. Security Operations & Threat Management

• Monitor & Support: Oversee daily operation of security tools (EDR, NDR, WAF, SIEM, PAM, MDM, Patching, etc.) and provide first-line incident response.

• Vulnerability & Risk: Conduct risk/vulnerability assessments, manage the risk register, and ensure timely remediation of technical threats.

• Emergency Preparedness: Lead disaster recovery (DR) and incident response drills; provide off-hours emergency support when required.

2. Infrastructure & System Hardening

• Network & Server Security: Configure and harden firewalls, network appliances, servers, and applications against baseline standards.

• Life-Cycle Support: Ensure security controls are integrated throughout system procurement, development, testing (UAT), and ongoing operations.

3. Compliance, Audit & Policy

• Government Standards: Review and align internal IT security policies with government circulars and baselines (e.g., S17, G3).

• Audits & Assessments: Manage Security Risk Assessment & Audit (SRAA) exercises, Privacy Impact Assessments (PIA), and external compliance checks.

4. Governance & Advisory

• Steering Support: Serve as a security administrator for committee meetings (e.g., ISSC) and present status updates.

• Technical Guidance: Provide expert advice on cloud security (GCIS/DCI, containers) and evolving business requirements.

5. Documentation & Administration

• Asset & Lifecycle Management: Track software end-of-support dates, plan migrations, and coordinate updates to network diagrams, capacity plans, and hardware/software inventories.

• Training & Procurement: Conduct internal security awareness training, assist with security tool procurement, and handle other supervisor-assigned duties.
  

Requirements:

• Degree in computer subjects or related disciplines

• At least 6 years working experience in IT industry with more than 3 years of hands-on experience working in the technology risk team, security operation team or security management unit of a sizeable organisation

• At least 1 of the industry-recognised IT security certifications (e.g. CISA, CISSP, CISP, etc.)

• Hands-on experience in technical support for IT security infrastructure, network equipment and security assessment tools (e.g., Cisco, H3C, Palo-Alto, Huawei, Nessus, OWASP Zap, etc.)

• Hands-on experience in IT security design, implementation and operations in application system development projects

• Experience in the technology and security risks of cloud-native applications running in a virtualised and/or containerized environment

• Experience in review and update IT security related documents

• Good command in spoken and written English and Chinese