The Technology Governance team provides security advice and guidance to OKX entities across all coverage areas, including global locations support business growth by working with all teams within the company to help them achieve their goals. This team works closely with compliance and legal teams to interpret global requirements for applying for licensing or any regional requirements, and understanding them.
What You’ll Be Doing
Security Review System & Virtual Organization Construction
-
System Establishment: Responsible for building the company-level security review process and governance framework from the ground up (0 to 1), defining collaboration mechanisms, and clarifying rights and responsibilities.
-
Process Integration: Seamlessly embed security controls into IT change and release processes. Establish security entry and blocking standards (Quality Gates) to ensure full visibility and control over the company's technical changes.
Security Architecture Design & Core System Assessment
-
Architecture Planning: Lead the security architecture design for cloud infrastructure (IaaS/PaaS) and business applications. Formulate high-scalability and high-performance security defense strategies and technical baselines for complex scenarios such as Cloud-Native environments (K8s/Containers) and microservices.
-
Deep Governance: Conduct specialized security governance for core systems to identify deep-seated architectural risks in product design, system development, and runtime environments; propose systematic remediation plans and lead their implementation.
Governance Operations & Executive Decision Support
-
Visibility Construction: Establish a routine reporting mechanism for security governance and reviews. Clearly present the security posture, major risks, and governance progress to management, providing data support for decision-making.
-
Closed-Loop Management: Drive relevant stakeholders to resolve bottlenecks identified during reviews. Promote cross-departmental risk remediation and architectural upgrades, ensuring a closed-loop management process from discovery to remediation.
Policy Construction & Enablement
-
Combine industry best practices (e.g., ISO27001, SDL, DevSecOps) with regulatory requirements to improve the company's information security management policies.
-
Empower R&D and Operations teams through virtual groups/teams to enhance overall security awareness.
What We Look For In You
Experience & Background
-
Education: Bachelor’s degree or above in Computer Science, Information Security, or related fields.
-
Experience: 5+ years of experience in internet/tech companies.
-
Key Experience: Proven experience in building security review systems from scratch or leading large-scale security governance projects. Experience operating cross-functional virtual organizations is preferred.
Professional Competencies
-
Architecture Skills: Proficient in mainstream cloud security architectures (AWS/Aliyun). Possesses a strong Application Security background (Web/API/Mobile), with a solid understanding of network, host, and data security principles. Capable of conducting threat modeling, architectural risk assessments, and designing solutions for complex business scenarios.
-
Offensive & Defensive Insight: Deep understanding of common security risks (OWASP Top 10) and attack vectors. Familiar with security development lifecycles (SDL/DevSecOps) and able to guide architectural design from an attacker/defender perspective.
Comprehensive Skills
-
Reporting & Communication: Strong logical thinking and professional writing skills (adept at writing governance weekly updates and analysis reports). Excellent cross-departmental communication and coordination skills to effectively drive cooperation between business and operations teams for remediation.
-
Project Management: Result-oriented. PMP certification or security certifications (CISSP, CISA, CCSP) are preferred.
Language Ability
- Proficiency in speaking, reading and writing in both English and Mandarin to collaborate effectively with global and cross-functional team members.
Perks & Benefits
-
Competitive total compensation package
-
L&D programs and Education subsidy for employees' growth and development
-
Various team building programs and company events
-
Wellness and meal allowances
-
Comprehensive healthcare schemes for employees and dependants
-
More that we love to tell you along the process!
