IT Security Analyst

Position Description

IT Security Analyst is responsible for IT Policies, Risk and Security Operation for HAECO HKG.

He/she is responsible for establishing and maintaining IT Policies, participating in different security projects to implement cybersecurity controls to meet security requirements and business needs, and managing IT risks and mitigations to reduce risk exposure.

He/she will work with service providers and various IT teams to deliver cybersecurity operations services, and have a hand-on administration on certain IT and security infrastructure.

What You'll Do

• IT Policies – Regular review IT Policies to keep them relevant and up to date.
• IT Security Operations and Management – Work with IT teams and service providers to handle security incidents. Follow up cybersecurity projects to ensure a quality delivery. Configure and operate different cybersecurity solutions.
• IT Security Governance, Risk Management and Compliance – Work with HK IT teams, Group IT or other HAECO entities to lay down security governance. Manage cyber and IT security risks. Ensure compliance to various security policies and procedures.

What You'll Need

• 5-8 years of experience in Cybersecurity or IT security project deliverables
• Bachelor’s or master’s degree in computer science, computer engineering, or a related field or discipline
• Working experience in information security technologies such as endpoint security, SIEM, DLP, WAF, IGA, SASE, ZTNA, NAC, email security and host & network firewalls
• Working experience with SOC and handling security alerts
• Infrastructure administration experience, including server, network, firewall and cloud computing
• Working knowledge on cloud infrastructure (especially Azure) and related cloud security products, e.g. CSPM, DSPM, PIM, NSG, Firewall, Front Door WAF
• Basic knowledge of application security and testing tools (e.g. DataDog, Trivy)
• Holder of IT Security certifications such as ISC2 CISSP CCSP CISM / CompTIA SecAI+ CySA+ / IAPP AIGP / ISACA CRISC CISM / GIAC GSEC GCSA / Azure security certifications (e.g. AZ-500) is an advantage
• Sound understanding of technological concepts, trends, capabilities and limitations
• Knowledge and experience in governance of AI adoptions, including LLMs and AI agents with Agent 365 and Power Platform, or equivalent exposure to AI risk frameworks (e.g. OWASP Top 10 for LLMs).
• Proven ability and skills to coordinate working IT teams / IT system owners on security policy governance and compliance.
• Working knowledge on local & global data security and privacy laws, e.g. PDPO, GDPR, CCPA, PIPL, CSL, DSL, MLPS2, and the experience to conduct a DPIA.
• Experience on ISO27001 (ISMS) certification and concepts on ISO 42001 (AIMS)
• Solid experience on IT product evaluation and vendor selection
• Experience in managing IT or security projects and vendor management

Successful candidates shall demonstrate their competency in security first line (e.g. security operations, monitoring, controls), second line (e.g. security governance, compliance, risk management), or both.