Information Security Expert_C

KEY RESPONSIBILITIES 2.1 COMPLIANCE & RISK MANAGEMENT (~40%) • Independently own the company’s information security governance program: develop the annual security and compliance roadmap, delivery plan, and resource requests - and be accountable for outcomes • Lead the build-out, operation, internal audit, and external certification of an ISO/IEC 27001 ISMS, driving non-conformity remediation to closure • Own China’s Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification, registration, gap assessment, and remediation • Operationalize obligations under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL): data classification and grading, PIAs, and cross-border transfer compliance • Establish the risk assessment methodology; lead annual risk assessments, ad-hoc assessments, and third-party / supply chain security reviews • Maintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forums • Interface with regulators, customer security audits, and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation quality • Provide compliance advisory and security review to business, product, and engineering teams, embedding security requirements upstream into processes • Drive policy rollout and compliance training; track departmental progress and tie results into performance evaluation 2.2 ENABLEMENT & SECURITY CULTURE (~25%) • Build a tiered security training program: compliance and awareness training for all staff, secure development training for engineers, and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curricula • Conduct security awareness campaigns (phishing simulations, security awareness week, case briefings) with measurable effectiveness evaluation and continuous improvement • Author and maintain company-level policies, technical standards, and security baselines; own rollout, Q&A, and adoption checks • Establish durable culture mechanisms: departmental security liaisons / security champions, security performance indicators, positive incentives, and violation reporting • Deliver presentations and training to varied audiences (executives, engineers, all staff), translating professional requirements into clear language and executable actions • Track global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets 2.3 SECURITY ARCHITECTURE & ENGINEERING (~15%) • Contribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to delivery • Lead or drive implementation of key controls: IAM / SSO, account and privilege governance, data encryption and masking, key management, endpoint and cloud security baselines • Conduct security reviews of major initiatives (cloud migration, core system re-architecture, new business launches); produce risk findings and remediation requirements, and follow through to resolution • Participate in security product selection and PoC validation; author company-level security baselines and technical specifications 2.4 PENETRATION TESTING & RED TEAMING (~10%) • Own authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan, manage external vendors, and control delivery quality • Review test plans, execution, and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testing • Conduct secure code reviews and software composition analysis (SCA); follow through on vul