Information Security Expert_C

KEY RESPONSIBILITIES
2.1 COMPLIANCE & RISK MANAGEMENT (~40%)
Independently own the company’s information security governance program: develop the annual security and compliance roadmap, delivery plan, and resource requests - and be accountable for
outcomes
Lead the build-out, operation, internal audit, and external certification of an ISO/IEC 27001 ISMS, driving non-conformity remediation to closure
Own China’s Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification, registration, gap assessment, and remediation
Operationalize obligations under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL): data classification and grading, PIAs, and cross-border transfer compliance
Establish the risk assessment methodology; lead annual risk assessments, ad-hoc assessments, and third-party / supply chain security reviews
Maintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forums
Interface with regulators, customer security audits, and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation quality
Provide compliance advisory and security review to business, product, and engineering teams, embedding security requirements upstream into processes
Drive policy rollout and compliance training; track departmental progress and tie results into performance evaluation
2.2 ENABLEMENT & SECURITY CULTURE (~25%)
Build a tiered security training program: compliance and awareness training for all staff, secure development training for engineers, and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curricula
Conduct security awareness campaigns (phishing simulations, security awareness week, case briefings) with measurable effectiveness evaluation and continuous improvement
Author and maintain company-level policies, technical standards, and security baselines; own rollout, Q&A, and adoption checks
Establish durable culture mechanisms: departmental security liaisons / security champions, security performance indicators, positive incentives, and violation reporting
Deliver presentations and training to varied audiences (executives, engineers, all staff), translating professional requirements into clear language and executable actions
Track global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets
2.3 SECURITY ARCHITECTURE & ENGINEERING (~15%)
Contribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to delivery
Lead or drive implementation of key controls: IAM / SSO, account and privilege governance, data encryption and masking, key management, endpoint and cloud security baselines
Conduct security reviews of major initiatives (cloud migration, core system re-architecture, new business launches); produce risk findings and remediation requirements, and follow through to resolution
Participate in security product selection and PoC validation; author company-level security baselines and technical specifications
2.4 PENETRATION TESTING & RED TEAMING (~10%)
Own authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan, manage external vendors, and control delivery quality
Review test plans, execution, and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testing
Conduct secure code reviews and software composition analysis (SCA); follow through on vulnerability remediation
Organize red team / purple team exercises and convert results into defensive improvements and training material
2.5 DETECTION & INCIDENT RESPONSE (~10%)
Drive detection capability: specify detection scenario requirements, follow through on rule implementation and false-positive suppression, and raise discovery rates for adversarial behavior
Establish and maintain alert severity classification, incident handling SOPs, and emergency response plans; conduct regular drills and post-incident reviews
Participate in triage, coordination, and root-cause review of major security incidents; deliver incident reports and drive remediation
Drive full-lifecycle vulnerability management and remediation tracking; coordinate with the operations team and enforce remediation SLAs
3.1 BASIC REQUIREMENTS
Bachelor’s degree or above; Information Security, Computer Science, Network Engineering, or Information Management preferred
4+ years of information security experience, including 3+ years independently owning security governance, compliance, risk, or a security program
An IT background: substantive work or project experience in networking, systems operations, software development, or cloud; able to review technical designs and engage effectively with engineering
Has led the build-out of an ISO 27001 / MLPS / data compliance program and taken it through external audit or regulatory inspection to full closure
3.2 TECHNICAL BACKGROUND & HANDS-ON CAPABILITY
This role is governance-led and does not carry a heavy offensive workload - however, it requires genuine technical grounding: understand it, verify it, hold the line. Engineering teams must not be able to explain away deficiencies.
IT Fundamentals: Understand the TCP/IP stack and common network architectures; familiar with Linux and Windows security mechanisms and hardening essentials for common middleware and databases
Technical Comprehension: Grasp Zero Trust, IAM/SSO, data encryption and masking, key management, and cloud-native / container security principles and control objectives; able to review whether a technical design satisfies compliance and security requirements
Vulnerability & Attack Knowledge: Familiar with OWASP Top 10, MITRE ATT&CK, and common vulnerability mechanics; able to reproduce and verify common vulnerabilities and judge whether a fix effectively closes the issue (no unknown-vulnerability research expected)
Tooling: Able to independently use common security tools for baseline checks - vulnerability scanning, configuration baseline review, asset and port discovery, account and privilege review - and to interpret scan reports and alerts
Data Handling: Working Python / Shell scripting for register maintenance, data reconciliation, and automated compliance checks
3.3 GOVERNANCE & COMPLIANCE CAPABILITY
Deep knowledge of ISO/IEC 27001, ISO/IEC 27701, MLPS 2.0, GDPR, and China’s cybersecurity and data protection legal framework; able to translate clauses into actionable controls and audit checkpoints
Proven ability to independently lead program build-out, conduct internal audits, manage external certification, and drive non-conformity remediation
Hands-on experience in risk assessment, data classification and grading, PIAs, and vendor security assessments
Substantive experience independently leading regulatory inspection responses and customer security audits
3.4 ENABLEMENT & TRAINING CAPABILITY
Has independently built an enterprise security training program or security awareness campaign
Able to design curricula, deliver training, and conduct rollout sessions; adjusts depth and framing for different audiences (executives, engineers, all staff)
Strong writing skills; able to independently produce policies, compliance reports, training materials, and executive-level briefings
3.5 INDUSTRY CERTIFICATIONS (KEY SCREENING CRITERION)
Candidates should hold at least one certification below. As this is a governance-led role, management-track and compliance/privacy certifications are preferred; technical certifications serve as supporting evidence.
International - Governance: CISSP, CISM, CISA, CRISC, CCSP
China - Compliance: CISP (CISE / CISO), CISAW, MLPS evaluator
certification, CCRC credentials
Privacy: IAPP CIPP/E, CIPM, CIPT, ISO 27701 qualifications
Technical Capability: CEH, Security+, OSCP, GPEN, GWAPT
Cloud Security: Alibaba Cloud / Tencent Cloud / Huawei Cloud security
certifications; AWS Security Specialty, Azure Security Engineer, CCSK
3.6 SOFT SKILLS
Operates independently: develops plans, coordinates resources, and drives results without requiring step-by-step direction
Strong cross-functional influence: builds consensus between business velocity, engineering efficiency, and compliance red lines – and drives remediation to closure
Communicates and trains effectively: explains risk to executives, requirements to engineers, and expected behavior to all staff
Balances principle with pragmatism: uncompromising on red lines, flexible on implementation
Strong documentation skills: independently produces policies, designs, reports, and training decks ready for review
English reading ability to work with original regulations and standards is a plus
======================================================================
4. NICE TO HAVE
ISO 27001 Lead Auditor (LA / LI) or certified internal auditor qualification
Independent teaching, corporate trainer, or industry speaking experience
Completed delivery of a data security governance or personal information protection compliance pr

Employment type
Full-time

Work arrangement
No