Technology and Security Risk Director

<div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxuseysYUio6Qia64JLLAwE7dh"> <div data-page-id="doxusokjWsaOkSCIjzixAfRM3sd" data-docx-has-block-data="false"> <div class="ace-line ace-line old-record-id-doxusaUYeCmu82WSkkm5KDd00db"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="AEW3d0Y2noLuIcxROuFubTLpsZd" data-docx-has-block-data="false"> <div data-page-id="NT3LdoNcGoaHjOxgxKxl5guHgVh" data-lark-html-role="root" data-docx-has-block-data="false"> <h2 class="heading-2 ace-line old-record-id-DZQvdevQhopllexqDd4lduZigNb"><strong>Who We Are</strong></h2> <div class="ace-line ace-line old-record-id-XAwbdHTvyoEPFMxQWdWlJew9ghb">At OKX, we believe that the future will be reshaped by crypto, and ultimately contribute to every individual's freedom.</div> <div class="ace-line ace-line old-record-id-CdrWdj0BroO15ux9xuGlaR7Rgph">OKX is a leading crypto exchange, and the developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications (dApps). OKX is also a trusted brand by hundreds of large institutions seeking access to crypto markets. We are safe and reliable, backed by our Proof of Reserves.</div> <div class="ace-line ace-line old-record-id-TlcBdKF44o5qeNxDWSTlnwtdgjg">Across our multiple offices globally, we are united by our core principles: <em>We Before Me</em>, <em>Do the Right Thing</em>, and <em>Get Things Done</em>. These shared values drive our culture, shape our processes, and foster a friendly, rewarding, and diverse environment for every OK-er.</div> <div class="ace-line ace-line old-record-id-MHQ3dPu3eocaL8xqQvKlcc7egZd">OKX is part of OKG, a group that brings the value of Blockchain to users around the world, through our leading products OKX, OKX Wallet, OKLink and more.</div> <div class="ace-line ace-line old-record-id-J6xfdKaFiozWenx6fQrld0oegkb">&nbsp;</div> <h2 class="heading-2 ace-line old-record-id-Z4Ard4wFyohkAoxSfVsl2j5cgVU"><strong>About the Opportunity</strong></h2> <div class="ace-line ace-line old-record-id-KeHEd8Kwho4QLhxAZGElcDKzgpf">We are seeking a highly motivated Technology and Security Risk Manager within the Second Line of Defence (2LOD).<strong> </strong>You will be responsible for continuously refining and scaling the Technology and Security oversight program, guiding first-line of defence (1LOD) execution, and providing independent risk challenge.</div> <div class="ace-line ace-line old-record-id-DPKYdAivVoaVS9xeZjUlMTHDgIb">You will be a key member of OKX's Risk team, helping to shape and scale the firm’s 2LOD Security &amp; Data Risk programs. You’ll work closely with stakeholders including Engineering, Product, Risk, Compliance and Internal Audit.</div> <div class="ace-line ace-line old-record-id-ISWndpzFZoLzv4xbrqdllMXzgfF">You will play a key role in developing and implementing a comprehensive Technology and Security Risk Management program. This includes 2LOD oversight of technology defects, issues, and incidents, Risk and Control Self-Assessments (RCSA), key risk indicators (KRIs) and reporting.</div> <div class="ace-line ace-line old-record-id-MHIud20omoKfvqxkbS3l1QTZgNc">The ideal candidate has a strong understanding of Technology Risk (including Technology Resilience, Change Management, SDLC, CI/CD pipeline, and software quality assurance) and Cybersecurity (covering internal and external threat vectors, control weaknesses, and organisational cyber hygiene). We are looking for a candidate with a strong drive for improvement and career growth.</div> <h2 class="heading-2 ace-line old-record-id-AtUhdK5WOooDOoxpBbClN3FMgGd"><strong>What You’ll Be Doing </strong></h2> <div class="ace-line ace-line old-record-id-Uar7dOqtbohb4Yx59E0lnNnqgyd">Collaborate with internal stakeholders across the company to proactively identify, escalate, assess, and mitigate Technology and Security risks, ensuring adherence to the Technology Risk Policy.</div> <div class="ace-line ace-line old-record-id-JdzVdUfNyoaKYGxAjmJlCpbjgpd">Providing oversight of Technology and Security Risk incidents and issues, and partnering with 1LOD stakeholders to enhance related processes and ensure effective oversight</div> <div class="ace-line ace-line old-record-id-Ntl9dW4eIoooLZx1vy0l8FUBgTF">Lead the Technology Risk and Control Self-Assessment (RCSA) process from a 2LOD perspective, ensuring adherence to the ERM RCSA methodology, and providing effective challenge and oversight of 1LOD Security risks and controls.</div> <div class="ace-line ace-line old-record-id-OxCZd5uyUoWeW5xJmzKltPVSgth">Support the Security Key Risk Indicators (KRIs) definition, monitoring, and reporting.</div> <div class="ace-line ace-line old-record-id-ZC2udRU0aofss0xQXWSlc5GPgJc">Supporting the implementation and ongoing enhancement of Governance, Risk, and Compliance (GRC) systems to enable effective risk oversight</div> <div class="ace-line ace-line old-record-id-LM08dA46zogknHxD76qlppWIgYb">Advocate and support the implementation of Risk Management frameworks for technology stakeholders, serving as a trusted advisor for the first line.</div> <div class="ace-line ace-line old-record-id-A9ZSdz8Euo2DcMxmGIClPNHfgrh">Stay up to date on emerging trends and regulations in the digital asset space, proactively identifying and addressing new risk considerations.</div> <h2 class="heading-2 ace-line old-record-id-Y7gadl7USoDfH4xG5dUl6etZgrJ"><strong>What We Look For In You </strong></h2> <ul class="list-bullet1"> <li class="ace-line ace-line old-record-id-B5WWd44j5o1jyTxZykolEGxbgrf" data-list="bullet"> <div>8+ years in information security, with a strong security architecture or technical security background; fintech, crypto or cloud-native experience preferred.</div> </li> <li class="ace-line ace-line old-record-id-QiOPdJoIIoPy4yxUvRzlxVyHgad" data-list="bullet"> <div>Practical experience designing, implementing or reviewing cloud, IAM, cryptographic, network or application security controls.</div> </li> <li class="ace-line ace-line old-record-id-VZUedga2koev7ixJxz5lBDNWggf" data-list="bullet"> <div>Experience in risk oversight, or readiness to transition, with the technical judgement to challenge controls and recommend proportionate improvements.</div> </li> <li class="ace-line ace-line old-record-id-FC1QdEw4foc56lxF6Fsl4pn6g1f" data-list="bullet"> <div>Ability to threat-model systems and assess technical evidence, including architecture diagrams, IAM policies, logging configurations and dependencies.</div> </li> <li class="ace-line ace-line old-record-id-LJlydjQcBoHiDBxUHN6lvUUSgab" data-list="bullet"> <div>Working knowledge of cloud resilience, multi-region/AZ failover, RTO/RPO and disaster recovery testing.</div> </li> <li class="ace-line ace-line old-record-id-VEqadg4IRoXyyfxmzK5ltw3Ag3e" data-list="bullet"> <div>Familiarity with NIST CSF, ISO 27001, SOC 2 and relevant privacy requirements, including GDPR and PDPA, and their application to technical controls.</div> </li> <li class="ace-line ace-line old-record-id-CbAedghhholU0DxKvWbltYuwgWf" data-list="bullet"> <div>Ability to independently assess and test controls, evaluate incidents and drive remediation with engineering and security teams; GRC platform experience desirable.</div> </li> <li class="ace-line ace-line old-record-id-PnAIdptymoKYpzx99stltlMXg8g" data-list="bullet"> <div>Clear written and verbal communication, translating technical findings into prioritised actions for business stakeholders and governance committees.</div> </li> <li class="ace-line ace-line old-record-id-SpJldYsm0oFQq3xrqM3lice9gSf" data-list="bullet"> <div>Strong stakeholder management skills, providing constructive challenge and collaborating across functions and geographies.</div> </li> <li class="ace-line ace-line old-record-id-MyiKdAA7joFhaYxFpOcl31Ksgzh" data-list="bullet"> <div>A proactive, adaptable approach, with confidence taking ownership and improving practices in a fast-paced environment.</div> </li> <li class="ace-line ace-line old-record-id-VnnqdxzsCo7XAQxHEB6lMpg0ghv" data-list="bullet"> <div>A relevant degree or equivalent practical experience; CISSP, CCSP, cloud security/architecture, CISA or CISM qualifications desirable.</div> </li> </ul> <h2 class="heading-2 ace-line old-record-id-XeXddhnS3oPyzzxEeWllz3Prgmd"><strong>Perks &amp; Benefits </strong></h2> <ul class="list-bullet1"> <li class="ace-line ace-line old-record-id-GL31dXVDkosWbWx8bNslNzoKguP" data-list="bullet"> <div>Competitive total compensation package</div> </li> <li class="ace-line ace-line old-record-id-G1D0dxaIAoKirmxBZLClTlgyghh" data-list="bullet"> <div>L&amp;D programs and Education subsidy for employees' growth and development</div> </li> <li class="ace-line ace-line old-record-id-CxMwdInlboWT4nxd868lgfjvg6c" data-list="bullet"> <div>Various team building programs and company events</div> </li> <li class="ace-line ace-line old-record-id-OxLSdspqXo7NmuxKaCZl6PYZgMg" data-list="bullet"> <div>Wellness and meal allowances</div> </li> <li class="ace-line ace-line old-record-id-Do7VdawYyoEGlqxa5gslaKQvgsb" data-list="bullet"> <div>Comprehensive healthcare schemes for employees and dependants</div> </li> <li class="ace-line ace-line old-record-id-Qmw0dXSI4oFy5pxQgcll3fFjg2T" data-list="bullet"> <div>More that we love to tell you along the process!</div> </li> </ul> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div> </div><div class="content-conclusion"><div data-lark-html-role="root"><span class="text-only" data-eleid="18"><span class="text-only"><span class="text-only" data-eleid="6">Notice:<br></span></span></span> <div data-lark-html-role="root"><span class="text-only" data-eleid="26"><span class="text-only">All official </span><span class="text-only text-with-abbreviation text-with-abbreviation-bottomline">OKX</span><span class="text-only"> vacancies are published on this website.</span></span> <span class="text-only" data-eleid="28"><span class="text-only">While roles may appear on selected third-party platforms from time to time, information on other sites may be inaccurate or outdated. </span></span><strong><span class="text-only" data-eleid="29"><span class="text-only">If in doubt, please apply directly through our official careers website.</span></span></strong></div> </div> <div data-lark-html-role="root"><span class="text-only" data-eleid="18"><span class="text-only">Information collected and processed as part of the recruitment process of any job application you choose to submit is subject to&nbsp;</span><span class="text-only text-with-abbreviation text-with-abbreviation-bottomline">OKX</span><span class="text-only">'s </span></span><a class="link rich-text-anchor __anchor-intercept-flag__ text-content-link" href="https://www.okx.com/en-eu/help/okx-candidate-privacy-notice" target="_blank" data-eleid="19" data-lark-is-custom="true" data-lark-link="true">Candidate Privacy Notice</a><span class="text-only" data-eleid="20"><span class="text-only">.</span></span></div></div>