IT Security Assurance Lead (Assessment and Penetration Test)

Reports to IT Security Assurance - Snr Lead

Lead the development and execution of IT security assurance and testing practices that underpin Cathay's technology landscape. You will assess initiatives, contracts, and applications for inherent risk, ensuring controls meet recognised standards while guiding the organisation on mitigation strategies and residual risk. Your work spans both structured assessments and hands-on testing disciplines, from risk evaluation to penetration testing and vulnerability analysis.

Operating at the intersection of security, technology, and business, you will define frameworks, refine processes, and elevate testing quality across projects and business-as-usual activities. This includes overseeing vendor delivery, embedding security testing into delivery lifecycles, and ensuring outputs-from test plans to execution approaches-are robust and fit for purpose.

As a leader, you will mentor a team of specialists, collaborate across internal security teams and business units, and keep pace with evolving cyber threats and industry practices such as Open Web Application Security Project (OWASP) and National Institute of Standards and Technology (NIST). Your contribution strengthens trust in Cathay's systems, supporting safe, reliable journeys and digital experiences for customers and colleagues alike.

• Item 1 of 10, Lead IT risk and security assessments, including tracking and driving mitigation of identified issuesLead IT risk and security assessments, including tracking and driving mitigation of identified issues
• Item 2 of 10, Communicate residual risks, vulnerabilities, and noncompliance clearly to senior management and stakeholdersCommunicate residual risks, vulnerabilities, and noncompliance clearly to senior management and stakeholders
• Item 3 of 10, Provide subject matter expertise in resolving reported security incidents and exception-based security requestsProvide subject matter expertise in resolving reported security incidents and exception-based security requests
• Item 4 of 10, Develop and maintain security assessment frameworks, methodologies, and control testing procedures (including cloud and contractual requirements)Develop and maintain security assessment frameworks, methodologies, and control testing procedures (including cloud and contractual requirements)
• Item 5 of 10, Oversee and enhance security testing frameworks and processes across projects and business-as-usual activitiesOversee and enhance security testing frameworks and processes across projects and business-as-usual activities
• Item 6 of 10, Manage and assure quality of vendor and internal testing, including reviewing test criteria, scenarios, and coverage against security requirementsManage and assure quality of vendor and internal testing, including reviewing test criteria, scenarios, and coverage against security requirements
• Item 7 of 10, Prioritise and allocate testing resources to meet multiple project timelines based on risk and criticalityPrioritise and allocate testing resources to meet multiple project timelines based on risk and criticality
• Item 8 of 10, Mentor and manage team members, supporting capability development and effective resource utilisationMentor and manage team members, supporting capability development and effective resource utilisation
• Item 9 of 10, Monitor evolving security threats, standards, and operating environments, adapting assurance approaches accordinglyMonitor evolving security threats, standards, and operating environments, adapting assurance approaches accordingly
• Item 10 of 10, Collaborate across teams to improve testing methodologies, promote secure coding practices, and deliver training on security testing techniques.Collaborate across teams to improve testing methodologies, promote secure coding practices, and deliver training on security testing techniques.

• Item 1 of 10, 5-7 years of relevant experience in IT security assurance and testing, with demonstrated experience leading small teams5-7 years of relevant experience in IT security assurance and testing, with demonstrated experience leading small teams
• Item 2 of 10, Certifications in penetration testing disciplines (for assessment focus), such as Offensive Security Certified Professional (OSCP), SANS Web Application Penetration Testing (GWAPT), Offensive Security Experienced Penetration Tester (OSEP), Offensive Security Web Expert (OSWE), Offensive Security Certified Expert (OSCE), or Certified Ethical Hacker (CEH)Certifications in penetration testing disciplines (for assessment focus), such as Offensive Security Certified Professional (OSCP), SANS Web Application Penetration Testing (GWAPT), Offensive Security Experienced Penetration Tester (OSEP), Offensive Security Web Expert (OSWE), Offensive Security Certified Expert (OSCE), or Certified Ethical Hacker (CEH)
• Item 3 of 10, Expert knowledge of security-related attacks, testing methodologies, standards, and assessment toolsExpert knowledge of security-related attacks, testing methodologies, standards, and assessment tools
• Item 4 of 10, Solid competencies in information security processes, frameworks, and technologies, including network and application vulnerability assessment, IT risk assessment, penetration testing and ethical hackingSolid competencies in information security processes, frameworks, and technologies, including network and application vulnerability assessment, IT risk assessment, penetration testing and ethical hacking
• Item 5 of 10, Working knowledge of recognised security standards and methodologies such as Open Web Application Security Project (OWASP), National Institute of Standards and Technology (NIST), Open Source Security Testing Methodology Manual (OSSTMM), and Open Source Intelligence (OSINT)Working knowledge of recognised security standards and methodologies such as Open Web Application Security Project (OWASP), National Institute of Standards and Technology (NIST), Open Source Security Testing Methodology Manual (OSSTMM), and Open Source Intelligence (OSINT)
• Item 6 of 10, Strong experience in vendor management and oversight of third-party delivery qualityStrong experience in vendor management and oversight of third-party delivery quality
• Item 7 of 10, Expert knowledge of security solutions and tools used in assurance and testing activitiesExpert knowledge of security solutions and tools used in assurance and testing activities
• Item 8 of 10, Strong communication skills, with the ability to articulate ideas clearly to a broad range of audiences and deliver impactful presentationsStrong communication skills, with the ability to articulate ideas clearly to a broad range of audiences and deliver impactful presentations
• Item 9 of 10, Strong interpersonal skills with the ability to build and maintain effective working relationships; proven management experience is an advantageStrong interpersonal skills with the ability to build and maintain effective working relationships; proven management experience is an advantage
• Item 10 of 10, Proactive, analytical, and customer-focused mindset, with strong problem-solving, troubleshooting, decision-making skills, and ability to understand end-user behaviour and drive positive outcomesProactive, analytical, and customer-focused mindset, with strong problem-solving, troubleshooting, decision-making skills, and ability to understand end-user behaviour and drive positive outcomes