Global Security Compliance COE

Key Responsibilities

Compliance Requirements TranslationLiaise with local compliance teams across global regions to develop a deep understanding of the security technical requirements under various regulatory frameworks (e.g., EU DORA, Turkey CMB/Tubitak, Hong Kong SFC). Translate compliance requirements into actionable security platform product requirements and technical solutions.

Audit & Certification SupportLead or participate in security audit preparation for compliance entities, including internal audits, external audits, penetration test report reviews, and audit evidence compilation and delivery — ensuring accuracy and timeliness of all audit materials.

Security Operations GovernanceDrive the implementation of security policies, processes, and standards across compliance entities, covering control domains such as vulnerability management, log monitoring (SIEM), antivirus coverage, access rights reviews, and security awareness training.

License Application SupportParticipate in the security-related components of financial license applications across regional compliance entities; author technical documentation including security architecture descriptions, control matrices, and risk assessments.

Security Metrics ManagementAssist in establishing and maintaining security operations metrics frameworks for each compliance entity (coverage rates, SLAs, compliance rates, etc.); produce regular security operations reports.

──────

Requirements

Bachelor's degree or above in Computer Science, Information Security, or a related field; 5+ years of experience in information security, with at least 3 years focused on security compliance governance, security auditing, or security operations.

Solid familiarity with mainstream security compliance frameworks and regulatory requirements such as ISO 27001, SOC 2, PCI DSS, and GDPR; knowledge of financial industry security regulations (e.g., DORA, MAS TRM) is a plus.

Strong security technical foundation with the ability to understand the working principles of security products and controls including SIEM, vulnerability scanning tools (Tenable/Orca/Nessus), EDR/antivirus, WAF, and IAM.

Hands-on experience participating in security audits (internal or external), with the ability to independently complete audit evidence preparation, control gap analysis, and remediation tracking.

Fluent in both Chinese and English; able to read regulatory documents in English, produce security compliance technical documentation, and communicate seamlessly with overseas teams.

Strong cross-functional communication and project execution skills; able to collaborate effectively across multiple time zones and cultural backgrounds.

──────

Bonus Points

Prior security compliance experience at a cryptocurrency exchange, payment institution, large internet company, or fintech firm.

Experience building multi-region / multi-site security compliance frameworks (not limited to a single region).

Familiarity with security platform/product development; ability to derive platform feature requirements from compliance needs.

Experience as an ISO 27001 internal auditor or participation in a SOC 2 Type II audit.

Holds certifications such as CISSP, CISM, CISA, or ISO 27001 LA/LI.

Direct hands-on experience with specific regional regulatory frameworks such as DORA, Tubitak, or SFC.