The proposed staff shall be responsible for providing technical support to the Thematic Inspection, Security Risk Assessment and Audit (SRAA) and Privacy Impact Assessment (PIA) of IT systems that include, but not limited to, the followings:

• Participating in procurement of SRAA and PIA services, such as preparing the requirement specifications and participating in tender evaluation;
  
• Liaising with parties concerned (including system administrators, security consultant, vendors) for conducting the SRAA and PIA, such as compiling the returns;
  
• Assisting project manager to monitor the progress of the SRAA and PIA services;
  
• Ensuing quality assurance of deliverables provided by the security consultant;
  
• Providing technical assistance to internal auditors in conducting the Thematic Inspection of IT systems;
  
• Providing guidance to system administrators for the SRAA, PIA and Thematic Inspection exercise;
  
• When IT security incident occurs, assisting IT system manager in evaluating the incident and perform
  preliminary assessment, handling the incident, and recover the systems and perform damage assessment;
  
• Conducting vulnerability scanning IT systems by using IT security scanning tools provided and summarize the findings and recommendations for management review;
  
• Performing any other duties as assigned by the supervisor.

• Higher Diploma/Degree holder in Computer Science or equivalent
  
• At least 4 years of relevant post-qualification working experience
  
• At least 1 year of working experience as a Systems Analyst
  
• Experience in supporting the SRAA and PIA projects
  
• Experience in supporting the internal security compliance audit is an advantage
  
• Experience in handling IT security incident is an advantage
  
• Familiar with Government regulations, policies, standards, guidelines, methodologies and qualify requirements, such as Baseline IT Security Policy, IT Security Guidelines, Practice Guide for Information Security Incident Handling and Stores and Procurement Regulations
  
• Holding Certified Information Security Professional (CISP) from China Information Technology Security Evaluation Centre (CNITSEC), Certified Information Security Member (CISM) from CNITSEC, Certified Information Systems Security Professional (CISSP) from International Information System Security Certification Consortium (ISC)2, Global Information Assurance Certification (GIAC) Security Expert (GSE) from SANS Institute, Certified Information Systems Auditor (CISA) from Information Systems Audit and Control Association (ISACA), ISO/IEC 27001 Lead Auditor from International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), or equivalent security certification
  
• Good communication and skills, both written and verbal, in Chinese and English
  
• Self-motivated, independent, diligent, polite, pro-active, fast-learning and good communication and problem-solving skills
  
• Undergoing integrity check by HKPF is required
  
• The job requires the following mandatory skills:
  
  • 2 years x Information Security Management, IT Security, Security Risk Assessment and Audit, IT Security Scanning Tools, Work experience with/in the Government, Experience in Managing Government IT Standards, IT Service/ Outsourcing Management, IT Procurement and Vendor Management