information security lead (web3)

只看有web3行业背景的人，优先上海办公。 Responsibilities 1. Information Security Management： • Draft and maintain information security policies, standards, and standard operating procedures (Policy / Standard / SOP). • Build, develop, and lead the information security team (engineers and compliance specialists) • Lead information security compliance initiatives, drive and maintain certifications such as ISO 27001 and SOC 2 Type II. • Establish a security awareness training program to improve security literacy across the company 2. Attack & Defense Framework: Lead the design and implementation of a defense-in-depth security architecture, covering network security, host security, application security (Web/API/mobile), cloud security (AWS/GCP/Azure), and blockchain infrastructure security 3. Security Operations (SecOps): Build or enhance SOC/SIEM capabilities; lead security incident detection, response, and forensics (IR process); conduct regular red team exercises and penetration tests. 4. Secure Development Lifecycle (SDL): Embed security shift-left practices into the full development lifecycle (code review, SAST/DAST, dependency vulnerability scanning, pre-release security assessment). 5. Infrastructure Security: Oversee internal network security architecture, zero trust network access, privileged access management (PAM), and endpoint security. 6. Crypto Threat Intelligence：Stay up-to-date with emerging crypto-specific threats (MEV attacks, flash loan attacks, oracle manipulation, etc.). 7. Regulatory Compliance & Policy Monitoring：Monitor regulatory developments in the digital asset industry (MiCA, VASP requirements, FATF guidelines) and develop compliance response strategies. 8. Cross-functional Collaboration: Work closely with Engineering, Product, Legal, and Operations to embed a security-first culture across the organization.Requirements 1. 8+ years of experience in information security, with at least 3 years in the digital asset industry (exchanges, wallets, DeFi, custodians, etc.). 2. Strong technical security foundation with deep expertise in at least two of the following: network security, cloud security, application security, cryptography & key management, blockchain/smart contract security. 3. Proficiency in Linux/Unix system security; hands-on experience in penetration testing or vulnerability research (OSCP, CEH, or equivalent certifications preferred). 4. Proficiency in at least one scripting language (Python, Go, or Rust) for automation and security tooling. 5. Excellent risk identification, communication, and cross-functional collaboration skills; ability to articulate complex technical risks clearly to non technical stakeholders. 6. Excellent incident response and crisis communication skills. Ability to independently drive projects to completion in a fast-moving, dynamic industry

• Assistant Vice President (AVP), Information Security Governance

  Hong Kong Exchanges and Clearing Limited (HKEX) · Hong Kong, Hong Kong SAR

• Deputy Head of Information Security, IT

  CLSA · Hong Kong, Hong Kong SAR

• Trainee, IT Service Delivery and Information Security (1 year contract)

  Aegon · Hong Kong SAR

• Vice President, Information Security and Digital Risk Management

  OCBC · Hong Kong, Hong Kong SAR

• Information Security Manager

  Hong Kong, Hong Kong SAR

• Vice President, Information Security and Digital Risk Management

  OCBC · Hong Kong SAR