Information Security Expert_C

KEY RESPONSIBILITIES

2.1 COMPLIANCE & RISK MANAGEMENT (~40%)

• Independently own the company’s information security governance program: develop the annual security and compliance roadmap, delivery plan, and resource requests - and be accountable for
  outcomes
• Lead the build-out, operation, internal audit, and external certification of an ISO/IEC 27001 ISMS, driving non-conformity remediation to closure
• Own China’s Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification, registration, gap assessment, and remediation
• Operationalize obligations under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL): data classification and grading, PIAs, and cross-border transfer compliance
• Establish the risk assessment methodology; lead annual risk assessments, ad-hoc assessments, and third-party / supply chain security reviews
• Maintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forums
• Interface with regulators, customer security audits, and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation quality
• Provide compliance advisory and security review to business, product, and engineering teams, embedding security requirements upstream into processes
• Drive policy rollout and compliance training; track departmental progress and tie results into performance evaluation

2.2 ENABLEMENT & SECURITY CULTURE (~25%)

• Build a tiered security training program: compliance and awareness training for all staff, secure development training for engineers, and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curricula
• Conduct security awareness campaigns (phishing simulations, security awareness week, case briefings) with measurable effectiveness evaluation and continuous improvement
• Author and maintain company-level policies, technical standards, and security baselines; own rollout, Q&A, and adoption checks
• Establish durable culture mechanisms: departmental security liaisons / security champions, security performance indicators, positive incentives, and violation reporting
• Deliver presentations and training to varied audiences (executives, engineers, all staff), translating professional requirements into clear language and executable actions
• Track global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets

2.3 SECURITY ARCHITECTURE & ENGINEERING (~15%)

• Contribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to delivery
• Lead or drive implementation of key controls: IAM / SSO, account and privilege governance, data encryption and masking, key management, endpoint and cloud security baselines
• Conduct security reviews of major initiatives (cloud migration, core system re-architecture, new business launches); produce risk findings and remediation requirements, and follow through to resolution
• Participate in security product selection and PoC validation; author company-level security baselines and technical specifications

2.4 PENETRATION TESTING & RED TEAMING (~10%)

• Own authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan, manage external vendors, and control delivery quality
• Review test plans, execution, and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testing
• Conduct secure code reviews and software composition analysis (SCA); follow through on vulnerability remediation
• Organize red team / purple team exercises and convert results into defensive improvements and training material

2.5 DETECTION & INCIDENT RESPONSE (~10%)

• Drive detection capability: specify detection scenario requirements, follow through on rule implementation and false-positive suppression, and raise discovery rates for adversarial behavior
• Establish and maintain alert severity classification, incident handling SOPs, and emergency response plans; conduct regular drills and post-incident reviews
• Participate in triage, coordination, and root-cause review of major security incidents; deliver incident reports and drive remediation
• Drive full-lifecycle vulnerability management and remediation tracking; coordinate with the operations team and enforce remediation SLAs

3.1 BASIC REQUIREMENTS

• Bachelor’s degree or above; Information Security, Computer Science, Network Engineering, or Information Management preferred
• 4+ years of information security experience, including 3+ years independently owning security governance, compliance, risk, or a security program
• An IT background: substantive work or project experience in networking, systems operations, software development, or cloud; able to review technical designs and engage effectively with engineering
• Has led the build-out of an ISO 27001 / MLPS / data compliance program and taken it through external audit or regulatory inspection to full closure

3.2 TECHNICAL BACKGROUND & HANDS-ON CAPABILITY

This role is governance-led and does not carry a heavy offensive workload - however, it requires genuine technical grounding: understand it, verify it, hold the line. Engineering teams must not be able to explain away deficiencies.

1. IT Fundamentals: Understand the TCP/IP stack and common network architectures; familiar with Linux and Windows security mechanisms and hardening essentials for common middleware and databases
2. Technical Comprehension: Grasp Zero Trust, IAM/SSO, data encryption and masking, key management, and cloud-native / container security principles and control objectives; able to review whether a technical design satisfies compliance and security requirements
3. Vulnerability & Attack Knowledge: Familiar with OWASP Top 10, MITRE ATT&CK, and common vulnerability mechanics; able to reproduce and verify common vulnerabilities and judge whether a fix effectively closes the issue (no unknown-vulnerability research expected)
4. Tooling: Able to independently use common security tools for baseline checks - vulnerability scanning, configuration baseline review, asset and port discovery, account and privilege review - and to interpret scan reports and alerts
5. Data Handling: Working Python / Shell scripting for register maintenance, data reconciliation, and automated compliance checks

3.3 GOVERNANCE & COMPLIANCE CAPABILITY

• Deep knowledge of ISO/IEC 27001, ISO/IEC 27701, MLPS 2.0, GDPR, and China’s cybersecurity and data protection legal framework; able to translate clauses into actionable controls and audit checkpoints
• Proven ability to independently lead program build-out, conduct internal audits, manage external certification, and drive non-conformity remediation
• Hands-on experience in risk assessment, data classification and grading, PIAs, and vendor security assessments
• Substantive experience independently leading regulatory inspection responses and customer security audits

3.4 ENABLEMENT & TRAINING CAPABILITY

• Has independently built an enterprise security training program or security awareness campaign
• Able to design curricula, deliver training, and conduct rollout sessions; adjusts depth and framing for different audiences (executives, engineers, all staff)
• Strong writing skills; able to independently produce policies, compliance reports, training materials, and executive-level briefings

3.5 INDUSTRY CERTIFICATIONS (KEY SCREENING CRITERION)

Candidates should hold at least one certification below. As this is a governance-led role, management-track and compliance/privacy certifications are preferred; technical certifications serve as supporting evidence.

• International - Governance: CISSP, CISM, CISA, CRISC, CCSP
• China - Compliance: CISP (CISE / CISO), CISAW, MLPS evaluator
  certification, CCRC credentials
• Privacy: IAPP CIPP/E, CIPM, CIPT, ISO 27701 qualifications
• Technical Capability: CEH, Security+, OSCP, GPEN, GWAPT
• Cloud Security: Alibaba Cloud / Tencent Cloud / Huawei Cloud security
  certifications; AWS Security Specialty, Azure Security Engineer, CCSK

3.6 SOFT SKILLS

• Operates independently: develops plans, coordinates resources, and drives results without requiring step-by-step direction
• Strong cross-functional influence: builds consensus between business velocity, engineering efficiency, and compliance red lines – and drives remediation to closure
• Communicates and trains effectively: explains risk to executives, requirements to engineers, and expected behavior to all staff
• Balances principle with pragmatism: uncompromising on red lines, flexible on implementation
• Strong documentation skills: independently produces policies, designs, reports, and training decks ready for review
• English reading ability to work with original regulations and standards is a plus

======================================================================
4. NICE TO HAVE

• ISO 27001 Lead Auditor (LA / LI) or certified internal auditor qualification
• Independent teaching, corporate trainer, or industry speaking experience
• Completed delivery of a data security governance or personal information protection compliance program
• Track record leading a major regulatory inspection or large-scale security remediation program
• First-hand experience in IT operations, development, or cloud platform delivery
• Contribution to national, industry, or group-level standards