Information Security Expert_C

KEY RESPONSIBILITIES

2.1 COMPLIANCE & RISK MANAGEMENT (~40%)

• Independently own the company’s information security governance program: develop the annual security and compliance roadmap, delivery plan, and resource requests - and be accountable for

outcomes
• Lead the build-out, operation, internal audit, and external certification of an ISO/IEC 27001 ISMS, driving non-conformity remediation to closure
• Own China’s Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification, registration, gap assessment, and remediation
• Operationalize obligations under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL): data classification and grading, PIAs, and cross-border transfer compliance
• Establish the risk assessment methodology; lead annual risk assessments, ad-hoc assessments, and third-party / supply chain security reviews
• Maintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forums
• Interface with regulators, customer security audits, and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation quality
• Provide compliance advisory and security review to business, product, and engineering teams, embedding security requirements upstream into processes
• Drive policy rollout and compliance training; track departmental progress and tie results into performance evaluation
2.2 ENABLEMENT & SECURITY CULTURE (~25%)

• Build a tiered security training program: compliance and awareness training for all staff, secure development training for engineers, and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curricula
• Conduct security awareness campaigns (phishing simulations, security awareness week, case briefings) with measurable effectiveness evaluation and continuous improvement
• Author and maintain company-level policies, technical standards, and security baselines; own rollout, Q&A;, and adoption checks
• Establish durable culture mechanisms: departmental security liaisons / security champions, security performance indicators, positive incentives, and violation reporting
• Deliver presentations and training to varied audiences (executives, engineers, all staff), translating professional requirements into clear language and executable actions
• Track global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets
2.3 SECURITY ARCHITECTURE & ENGINEERING (~15%)

• Contribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to delivery
• Lead or drive implementation of key controls: IAM / SSO, account and privilege governance, data encryption and masking, key management, endpoint and cloud security baselines
• Conduct security reviews of major initiatives (cloud migration, core system re-architecture, new business launches); produce risk findings and remediation requirements, and follow through to resolution
• Participate in security product selection and PoC validation; author company-level security baselines and technical specifications
2.4 PENETRATION TESTING & RED TEAMING (~10%)

• Own authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan, manage external vendors, and control delivery quality
• Review test plans, execution, and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testing
• Conduct secure code reviews and software composition analysis (SCA); follow through on vulnerability remediation
• Organize red team / purple team exercises and convert results into defensive improvements and training material
2.5 DETECTION & INCIDENT RESPONSE (~10%)

• Drive detection capability: specify detection scenario requirements, follow through on rule implementation and false-positive suppression, and raise discovery rates for adversarial behavior
• Establish and maintain alert severity classification, incident handling SOPs, and emergency response plans; conduct regular drills and post-incident reviews
• Participate in triage, coordination, and root-cause review of major security incidents; deliver incident reports and drive remediation
• Drive full-lifecycle vulnerability management and remediation tracking; coordinate with the operations team and enforce remediation SLAs

Function: Information Technology
Experience Level: Associate