Information Security Expert_C

KEY RESPONSIBILITIES

2.1 COMPLIANCE & RISK MANAGEMENT (~40%)

• Independently own the company’s information security governance program: develop the annual security and compliance roadmap, delivery plan, and resource requests - and be accountable for

outcomes

• Lead the build-out, operation, internal audit, and external certification of an ISO/IEC 27001 ISMS, driving non-conformity remediation to closure
• Own China’s Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification, registration, gap assessment, and remediation
• Operationalize obligations under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL): data classification and grading, PIAs, and cross-border transfer compliance
• Establish the risk assessment methodology; lead annual risk assessments, ad-hoc assessments, and third-party / supply chain security reviews
• Maintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forums
• Interface with regulators, customer security audits, and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation quality
• Provide compliance advisory and security review to business, product, and engineering teams, embedding security requirements upstream into processes
• Drive policy rollout and compliance training; track departmental progress and tie results into performance evaluation

2.2 ENABLEMENT & SECURITY CULTURE (~25%)

• Build a tiered security training program: compliance and awareness training for all staff, secure development training for engineers, and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curricula
• Conduct security awareness campaigns (phishing simulations, security awareness week, case briefings) with measurable effectiveness evaluation and continuous improvement
• Author and maintain company-level policies, technical standards, and security baselines; own rollout, Q&A, and adoption checks
• Establish durable culture mechanisms: departmental security liaisons / security champions, security performance indicators, positive incentives, and violation reporting
• Deliver presentations and training to varied audiences (executives, engineers, all staff), translating professional requirements into clear language and executable actions
• Track global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets

2.3 SECURITY ARCHITECTURE & ENGINEERING (~15%)

• Contribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to delivery
• Lead or drive implementation of key controls: IAM / SSO, account and privilege governance, data encryption and masking, key management, endpoint and cloud security baselines
• Conduct security reviews of major initiatives (cloud migration, core system re-architecture, new business launches); produce risk findings and remediation requirements, and follow through to resolution
• Participate in security product selection and PoC validation; author company-level security baselines and technical specifications

2.4 PENETRATION TESTING & RED TEAMING (~10%)

• Own authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan, manage external vendors, and control delivery quality
• Review test plans, execution, and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testing
• Conduct secure code reviews and software composition analysis (SCA); follow through on vulnerability remediation
• Organize red team / purple team exercises and convert results into defensive improvements and training material

2.5 DETECTION & INCIDENT RESPONSE (~10%)

• Drive detection capability: specify detection scenario requirements, follow through on rule implementation and false-positive suppression, and raise discovery rates for adversarial behavior
• Establish and maintain alert severity classification, incident handling SOPs, and emergency response plans; conduct regular drills and post-incident reviews
• Participate in triage, coordination, and root-cause review of major security incidents; deliver incident reports and drive remediation
• Drive full-lifecycle vulnerability management and remediation tracking; coordinate with the operations team and enforce remediation SLAs

3.1 BASIC REQUIREMENTS

• Bachelor’s degree or above; Information Security, Computer Science, Network Engineering, or Information Management preferred
• 4+ years of information security experience, including 3+ years independently owning security governance, compliance, risk, or a security program
• An IT background: substantive work or project experience in networking, systems operations, software development, or cloud; able to review technical designs and engage effectively with engineering
• Has led the build-out of an ISO 27001 / MLPS / data compliance program and taken it through external audit or regulatory inspection to full closure

3.2 TECHNICAL BACKGROUND & HANDS-ON CAPABILITY

This role is governance-led and does not carry a heavy offensive workload - however, it requires genuine technical grounding: understand it, verify it, hold the line. Engineering teams must not be able to explain away deficiencies.

• IT Fundamentals: Understand the TCP/IP stack and common network architectures; familiar with Linux and Windows security mechanisms and hardening essentials for common middleware and databases
• Technical Comprehension: Grasp Zero Trust, IAM/SSO, data encryption and masking, key management, and cloud-native / container security principles and control objectives; able to review whether a technical design satisfies compliance and security requirements
• Vulnerability & Attack Knowledge: Familiar with OWASP Top 10, MITRE ATT&CK, and common vulnerability mechanics; able to reproduce and verify common vulnerabilities and judge whether a fix effectively closes the issue (no unknown-vulnerability research expected)
• Tooling: Able to independently use common security tools for baseline checks - vulnerability scanning, configuration baseline review, asset and port discovery, account and privilege review - and to interpret scan reports and alerts
• Data Handling: Working Python / Shell scripting for register maintenance, data reconciliation, and automated compliance checks

3.3 GOVERNANCE & COMPLIANCE CAPABILITY

• Deep knowledge of ISO/IEC 27001, ISO/IEC 27701, MLPS 2.0, GDPR, and China’s cybersecurity and data protection legal framework; able to translate clauses into actionable controls and audit checkpoints
• Proven ability to independently lead program build-out, conduct internal audits, manage external certification, and drive non-conformity remediation
• Hands-on experience in risk assessment, data classification and grading, PIAs, and vendor security assessments
• Substantive experience independently leading regulatory inspection responses and customer security audits

3.4 ENABLEMENT & TRAINING CAPABILITY

• Has independently built an enterprise security training program or security awareness campaign
• Able to design curricula, deliver training, and conduct rollout sessions; adjusts depth and framing for different audiences (executives, engineers, all staff)
• Strong writing skills; able to independently produce policies, compliance reports, training materials, and executive-level briefings

3.5 INDUSTRY CERTIFICATIONS (KEY SCREENING CRITERION)

Candidates should hold at least one certification below. As this is a governance-led role, management-track and compliance/privacy certifications are preferred; technical certifications serve as supporting evidence.

• International - Governance: CISSP, CISM, CISA, CRISC, CCSP
• China - Compli