Department:
FSD

Job nature:
(T26) To assist the Systems Manager in planning, managing and conducting various cybersecurity activities such as establishing internal control measures, managing independent third-party assessment activities (i.e. SRAA, PIA, compliance audit, vulnerability scanning exercises, etc.). The CSA shall provide front-tier support for cybersecurity activities and application development projects.

Responsibilities:
(T26)
(i) To establish and enforce internal IT security controls; (ii) To manage and monitor the conduct of SRAA, PIA as well as other activities conducted by independent third-party; (iii) To provide hands-on support on managing security appliances such as firewalls, WAFs, proxy servers, SIEM tools, etc; (iv) To prepare project documentation and technical writing, including but not limited to requirements specifications, SA&D Report, UAT Plan, and meeting minutes
(v) To review project deliverables to ensure that quality standards, timelines and contractual requirements are met; (vi) To prepare technical specifications for the procurement of IT products and services required by the projects; (vii) To perform any other duties related to the above as assigned by supervisor or the Government Representative from time to time; (viii) To be able to work under pressure and willing to work overtime if required; and To provide on-call technical support duties and perform overtime work, including work outside of normal office hours, on Saturdays, Sundays, and public holidays, as and when necessary and upon the request of the Government Representative.

Requirements:
(i) At least four
(4) years&;#8217; post-qualification information technology experience of which at least three
(3) year working experience in related area; (ii) Possession of a recognised professional cybersecurity qualification, such as Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA) or Certified Information Security Professional (CISP), or equivalent cybersecurity qualifications; (iii) Possession of practical cybersecurity qualifications, such as Offensive Security Certified Professional, GIAC Penetration Tester, Certified Ethical Hacker (Practical), or equivalent cybersecurity qualification, will be an advantage; (iv) Hands-on experience in IT security, including risk assessment, risk management and risk controls
(v) Hands-on experience in common programming languages and related tools / technologies; (vi) Experience in managing outsourced contractor throughout the whole system development life cycle (SDLC); (vii) Proficiency in written and spoken Chinese and English; and (viii) Security vetting is required.

Technical skills:
IT Application Development and Management (24)
IT Security (12)
Networking (12)
Structured Query Language (36)
System Implementation and Maintenance/Support (36)
Web Programming (24)