Technical Manager, Vulnerability Management (Penetration Testing)

Sits within the Cyber Security Department of The Hong Kong Jockey Club's IT Division, which is a first line of defence safeguarding information assets, IT systems, networks, and cloud platforms. The department ensures resilience and continuity of critical operations through risk governance frameworks and cybersecurity standards, and protects the Club against emerging threats while ensuring compliance in Hong Kong and China. The role performs penetration testing and vulnerability assessment across applications, systems, and infrastructure, supports remediation, and works with project teams and stakeholders to understand testing requirements and deliverables.

• Perform penetration testing and vulnerability assessment activities across applications, systems, and infrastructure to identify security weaknesses and support their remediation.
• Support penetration testing requests by working with project teams and stakeholders to understand requirements, testing scope, and expected deliverables.
• Conduct security testing and vulnerability assessments, including system and infrastructure security reviews, web application penetration testing, mobile application security testing, and vulnerability scanning and prioritisation.
• Identify, validate, and, where appropriate, exploit vulnerabilities using manual testing techniques and automated security tools.
• Develop and maintain scripts, payloads, and testing utilities to support penetration testing and improve testing efficiency.
• Prepare clear and accurate technical reports documenting findings, supporting evidence, risk impact, and recommended remediation actions in accordance with organisational cybersecurity standards.
• Work with stakeholders to communicate findings, clarify remediation requirements, and follow up on the progress and closure of identified vulnerabilities
• Maintain dashboards, metrics, and KRIs to support monitoring of cybersecurity posture, vulnerability remediation, and regular management reporting.
• Contribute to the maintenance and continuous improvement of penetration testing and vulnerability management procedures, methodologies, standards, and documentation.
• Coordinate with external security testing vendors where required, supporting service delivery and monitoring activities against agreed requirements and SLAs.
• Work collaboratively with team members and other technology teams, share technical knowledge, and contribute to a positive and inclusive team culture.

• Bachelor's and/or Postgraduate degree from a highly accredited university in Computer Science, Information Technology, Software Engineering, Cyber Security, or a similar field.
• Industry-recognised certification in one or more of OSCP, OSCE, OSWE, GPEN, CEH, CISSP, CISM, or equivalent.
• 5 years or more of working experience in the penetration testing and vulnerability management domain across various disciplines.
• Hands-on experience with industry-standard tools such as Kali Linux, Burp Suite, Qualys, Nessus, Nmap, Metasploit, Wireshark, etc.
• Deep technical knowledge in operating systems (Windows, Linux, macOS)
• Offensive tooling and techniques (implant reverse shells, Command and Control (C2) infrastructure)
• Network and security architecture (TCP/IP, IDS/IPS, firewalls, WAFs, web content filtering)
• Cloud platform (integrated security solutions across major cloud providers, e.g. AWS, Azure)
• And application security (coding practices and architecture design).
• Demonstrated ability to perform penetration testing, vulnerability assessments, and security reviews for applications and infrastructure.
• Contribute to the development and refinement of penetration testing and secure vulnerability management standards.
• Proven expertise in conducting application security assessments across web, mobile, and self-developed applications.
• Strong service and customer-focused approach to the service being delivered.
• Excellent interpersonal, collaborative and communication skills.
• Well-disciplined with exemplary professional competence and integrity.

• Experience participating in red team operations is desired.
• Exploit research and development skills are a plus.
• Source code review experience is a plus.

• Competitive salary and benefits package
• Dynamic working environment
• Development opportunities

Its Charities Trust is one of the world's leading charity donors.