Full Description

The Hong Kong Jockey Club Founded in 1884, The Hong Kong Jockey Club (“the Club”) is a world-class racing club that acts continuously for the betterment of our society. The Club has a unique integrated business model, comprising racing and racecourse entertainment, a membership club, responsible sports wagering and lottery, and charities and community contribution. Through this model, the Club generates economic and social value for the community and supports the HKSAR Government in combatting illegal gambling.Who are we? We are the IT Division of HKJC, a vibrant community of over 1,500 dedicated professionals working collaboratively across Hong Kong and Shenzhen. Our team is a diverse mix of individuals from various backgrounds, from all across the world. We embrace our humanity, recognizing that each of us brings unique strengths and perspectives. This diversity not only enriches our work environment but also drives our innovation and creativity as we strive to achieve our collective goals.What do we do? We design, build, and operate the technology that powers the Club. Our primary focus is on delivering the service that supports our hospitality, racing and wagering operations, to ensure that our customers and members enjoy exceptional experiences. We also deliver the changes necessary to drive business growth through new products and services. And, we are committed to safeguarding the Club by protecting it from external threats, providing a secure and resilient technological environment.The Department The Cyber Security Department is essential to the Club’s ongoing success, safeguarding information assets, IT systems, networks, and cloud platforms while ensuring the resilience and continuity of critical operations. Through the implementation of strong risk governance frameworks and cybersecurity standards, the department protects the Club against emerging threats and ensures compliance with regulatory requirements in Hong Kong and China. As the first line of defense, the department plays a key role in maintaining the Club’s reputation and operational resilience. Its core responsibilities include identifying and addressing vulnerabilities, protecting sensitive information, ensuring rapid incident response, overseeing access management, and promoting Club-wide cybersecurity awareness.The Job Lead and oversee penetration testing engagements end-to-end, ensuring high-quality execution across applications and environments to uncover and address security weaknesses Act as a trusted Subject Matter Expert, supporting penetration testing requests, anticipating project requirements, and providing practical, effective solutions

Perform and coordinate penetration testing and vulnerability assessments, including

System and infrastructure security reviews Web application penetration testing Mobile application security testing Vulnerability scanning and prioritisation

Identify, validate, and exploit vulnerabilities using advanced manual techniques and automated tools to strengthen security posture Develop and refine custom scripts, payloads, and exploits to test resilience against security controls Deliver detailed technical reports and remediation guidance, ensuring findings are clearly documented and aligned with organisational cybersecurity standards Engage stakeholders to communicate findings and remediation priorities, tracking progress to ensure timely closure of vulnerabilities Design and maintain dashboards and metrics (KRIs) to monitor cybersecurity posture and provide regular reporting to management Contribute to the development and improvement of internal standards, methodologies, and documentation for penetration testing and vulnerability management Manage vendor relationships, ensuring service quality and monitoring performance against agreed SLAs Support broader cybersecurity initiatives by undertaking additional responsibilities as directed by Cyber Security Management Promote a collaborative and inclusive team culture, actively contributing to cross-team efforts and modelling cooperative behaviours About You University degree qualification in Computer Science, Information Technology, cybersecurity or related discipline Industry-recognised certification in one or more of the following – OSCP, OSCE, OSWE, GPEN, CEH, CISSP, CISA, or equivalent 10 years or more of working experience in the penetration testing and vulnerability management domain across various disciplines Hands-on experience with industry-standard tools such as Kali Linux, Burp Suite, Qualys, Nessus, Nmap, Metasploit, Wireshark, etc.