KEY RESPONSIBILITIES
2.1 COMPLIANCE & RISK MANAGEMENT (~40%)
- Independently own the company’s information security governance program: develop the annual security and compliance roadmap, delivery plan, and resource requests - and be accountable for
outcomes - Lead the build-out, operation, internal audit, and external certification of an ISO/IEC 27001 ISMS, driving non-conformity remediation to closure
- Own China’s Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification, registration, gap assessment, and remediation
- Operationalize obligations under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL): data classification and grading, PIAs, and cross-border transfer compliance
- Establish the risk assessment methodology; lead annual risk assessments, ad-hoc assessments, and third-party / supply chain security reviews
- Maintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forums
- Interface with regulators, customer security audits, and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation quality
- Provide compliance advisory and security review to business, product, and engineering teams, embedding security requirements upstream into processes
- Drive policy rollout and compliance training; track departmental progress and tie results into performance evaluation
2.2 ENABLEMENT & SECURITY CULTURE (~25%)
- Build a tiered security training program: compliance and awareness training for all staff, secure development training for engineers, and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curricula
- Conduct security awareness campaigns (phishing simulations, security awareness week, case briefings) with measurable effectiveness evaluation and continuous improvement
- Author and maintain company-level policies, technical standards, and security baselines; own rollout, Q&A, and adoption checks
- Establish durable culture mechanisms: departmental security liaisons / security champions, security performance indicators, positive incentives, and violation reporting
- Deliver presentations and training to varied audiences (executives, engineers, all staff), translating professional requirements into clear language and executable actions
- Track global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets
2.3 SECURITY ARCHITECTURE & ENGINEERING (~15%)
- Contribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to delivery
- Lead or drive implementation of key controls: IAM / SSO, account and privilege governance, data encryption and masking, key management, endpoint and cloud security baselines
- Conduct security reviews of major initiatives (cloud migration, core system re-architecture, new business launches); produce risk findings and remediation requirements, and follow through to resolution
- Participate in security product selection and PoC validation; author company-level security baselines and technical specifications
2.4 PENETRATION TESTING & RED TEAMING (~10%)
- Own authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan, manage external vendors, and control delivery quality
- Review test plans, execution, and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testing
- Conduct secure code reviews and software composition analysis (SCA); follow through on vulnerability remediation
- Organize red team / purple team exercises and convert results into defensive improvements and training material
2.5 DETECTION & INCIDENT RESPONSE (~10%)
- Drive detection capability: specify detection scenario requirements, follow through on rule implementation and false-positive suppression, and raise discovery rates for adversarial behavior
- Establish and maintain alert severity classification, incident handling SOPs, and emergency response plans; conduct regular drills and post-incident reviews
- Participate in triage, coordination, and root-cause review of major security incidents; deliver incident reports and drive remediation
- Drive full-lifecycle vulnerability management and remediation tracking; coordinate with the operations team and enforce remediation SLAs