Security Configuration

• Manage and maintain enterprise security configuration standards and baselines. 

• Review and adopt the latest Center for Internet Security (CIS) Benchmarks, ensuring alignment with HKEX security requirements. 

• Oversee updates to security configuration scanning tools to incorporate the latest CIS Benchmarks and security checks. 

• Develop, review, and maintain Generic Security Baselines (GSBs) for technologies and platforms not covered by CIS Benchmarks. 

• Ensure security configuration standards remain current, effective, and aligned with industry best practices and regulatory requirements. 

Security Exception Management

• Administer the security exception management process for security findings. 

• Review and validate exception requests to confirm that appropriate business justification, risk assessment, compensating controls, and management approvals are in place. 

• Assess and validate potential false-positive findings identified through security configuration scans. 

• Maintain accurate records of approved exceptions and monitor their validity periods and expiry dates. 

Security Governance Operations and Approval

• Perform governance and approval activities to ensure security standards and operational requirements are met. 

Whitelisting

• Review and approve website, file upload and email whitelisting requests in accordance with established security policies and risk management requirements. 

Encryption and Key Management

• Review and approve encryption key management requests and related activities according to cryptographic standards and key management requirements. 

Internal Certificate Authority (CA) Governance

• Review and approve requests related to internal Certificate Authority (CA) certificates and ensure proper issuance, renewal, usage, and management of digital certificates. 

 Privileged Elevation Governance

• Review and approve SUDO registration and privileged escalation and ensure requests is granted with least-privilege and security governance principles. 

Security Acceptance Review

• Conduct Security Acceptance Checklist (SAC) reviews and approvals as part of the SDLC process control. 

• Assess and approve SSR requests stating security requirements are not applicable, ensuring adequate justification and risk assessment are documented. 

Non-Standard Software Assessment

• Review and approve requests for installation of non-standard software, with evaluation of associated operational, security, compliance, and technology risks. Ensure appropriate mitigating controls are established before approval

Job Requirement: