Information Security ExpertC

KEY RESPONSIBILITIES

2.1 COMPLIANCE & RISK MANAGEMENT (40%)

• Independently own the companys information security governance program: develop the annual security and compliance roadmap delivery plan and resource requests - and be accountable for
  outcomes
• Lead the build-out operation internal audit and external certification of an ISO/IEC 27001 ISMS driving non-conformity remediation to closure
• Own Chinas Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification registration gap assessment and remediation
• Operationalize obligations under the Cybersecurity Law Data Security Law and Personal Information Protection Law (PIPL): data classification and grading PIAs and cross-border transfer compliance
• Establish the risk assessment methodology; lead annual risk assessments ad-hoc assessments and third-party / supply chain security reviews
• Maintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forums
• Interface with regulators customer security audits and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation quality
• Provide compliance advisory and security review to business product and engineering teams embedding security requirements upstream into processes
• Drive policy rollout and compliance training; track departmental progress and tie results into performance evaluation

2.2 ENABLEMENT & SECURITY CULTURE (25%)

• Build a tiered security training program: compliance and awareness training for all staff secure development training for engineers and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curricula
• Conduct security awareness campaigns (phishing simulations security awareness week case briefings) with measurable effectiveness evaluation and continuous improvement
• Author and maintain company-level policies technical standards and security baselines; own rollout Q&A and adoption checks
• Establish durable culture mechanisms: departmental security liaisons / security champions security performance indicators positive incentives and violation reporting
• Deliver presentations and training to varied audiences (executives engineers all staff) translating professional requirements into clear language and executable actions
• Track global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets

2.3 SECURITY ARCHITECTURE & ENGINEERING (15%)

• Contribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to delivery
• Lead or drive implementation of key controls: IAM / SSO account and privilege governance data encryption and masking key management endpoint and cloud security baselines
• Conduct security reviews of major initiatives (cloud migration core system re-architecture new business launches); produce risk findings and remediation requirements and follow through to resolution
• Participate in security product selection and PoC validation; author company-level security baselines and technical specifications

2.4 PENETRATION TESTING & RED TEAMING (10%)

• Own authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan manage external vendors and control delivery quality
• Review test plans execution and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testing
• Conduct secure code reviews and software composition analysis (SCA); follow through on vulnerability remediation
• Organize red team / purple team exercises and convert results into defensive improvements and training material

2.5 DETECTION & INCIDENT RESPONSE (10%)

• Drive detection capability: specify detection scenario requirements follow through on rule implementation and false-positive suppression and raise discovery rates for adversarial behavior
• Establish and maintain alert severity classification incident handling SOPs and emergency response plans; conduct regular drills and post-incident reviews
• Participate in triage coordination and root-cause review of major security incidents; deliver incident reports and drive remediation
• Drive full-lifecycle vulnerability management and remediation tracking; coordinate with the operations team and enforce remediation SLAs

Qualifications :

3.1 BASIC REQUIREMENTS

• Bachelors degree or above; Information Security Computer Science Network Engineering or Information Management preferred
• 4 years of information security experience including 3 years independently owning security governance compliance risk or a security program
• An IT background: substantive work or project experience in networking systems operations software development or cloud; able to review technical designs and engage effectively with engineering
• Has led the build-out of an ISO 27001 / MLPS / data compliance program and taken it through external audit or regulatory inspection to full closure

3.2 TECHNICAL BACKGROUND & HANDS-ON CAPABILITY

This role is governance-led and does not carry a heavy offensive workload - however it requires genuine technical grounding: understand it verify it hold the line. Engineering teams must not be able to explain away deficiencies.

1. IT Fundamentals: Understand the TCP/IP stack and common network architectures; familiar with Linux and Windows security mechanisms and hardening essentials for common middleware and databases
2. Technical Comprehension: Grasp Zero Trust IAM/SSO data encryption and masking key management and cloud-native / container security principles and control objectives; able to review whether a technical design satisfies compliance and security requirements
3. Vulnerability & Attack Knowledge: Familiar with OWASP Top 10 MITRE ATT&CK and common vulnerability mechanics; able to reproduce and verify common vulnerabilities and judge whether a fix effectively closes the issue (no unknown-vulnerability research expected)
4. Tooling: Able to independently use common security tools for baseline checks - vulnerability scanning configuration baseline review asset and port discovery account and privilege review - and to interpret scan reports and alerts
5. Data Handling: Working Python / Shell scripting for register maintenance data reconciliation and automated compliance checks

3.3 GOVERNANCE & COMPLIANCE CAPABILITY

• Deep knowledge of ISO/IEC 27001 ISO/IEC 27701 MLPS 2.0 GDPR and Chinas cybersecurity and data protection legal framework; able to translate clauses into actionable controls and audit checkpoints
• Proven ability to independently lead program build-out conduct internal audits manage external certification and drive non-conformity remediation
• Hands-on experience in risk assessment data classification and grading PIAs and vendor security assessments
• Substantive experience independently leading regulatory inspection responses and customer security audits

3.4 ENABLEMENT & TRAINING CAPABILITY

• Has independently built an enterprise security training program or security awareness campaign
• Able to design curricula deliver training and conduct rollout sessions; adjusts depth and framing for different audiences (executives engineers all staff)
• Strong writing skills; able to independently produce policies compliance reports training materials and executive-level briefings

3.5 INDUSTRY CERTIFICATIONS (KEY SCREENING CRITERION)

Candidates should hold at least one certification below. As this is a governance-led role management-track and compliance/privacy certifications are preferred; technical certifications serve as supporting evidence.

• International - Governance: CISSP CISM CISA CRISC CCSP
• China - Compliance: CISP (CISE / CISO) CISAW MLPS evaluator
  certification CCRC credentials
• Privacy: IAPP CIPP/E CIPM CIPT ISO 27701 qualifications
• Technical Capability: CEH Security OSCP GPEN GWAPT
• Cloud Security: Alibaba Cloud / Tencent Cloud / Huawei Cloud security
  certifications; AWS Security Specialty Azure Security Engineer CCSK

3.6 SOFT SKILLS

• Operates independently: develops plans coordinates resources and drives results without requiring step-by-step direction
• Strong cross-functional influence: builds consensus between business velocity engineering efficiency and compliance red lines and drives remediation to closure
• Communicates and trains effectively: explains risk to executives requirements to engineers and expected behavior to all staff
• Balances principle with pragmatism: uncompromising on red lines flexible on implementation
• Strong documentation skills: independently produces policies designs reports and training decks ready for review
• English reading ability to work with original regulations and standards is a plus

4. NICE TO HAVE

• ISO 27001 Lead Auditor (LA / LI) or certified internal auditor qualification
• Independent teaching corporate trainer or industry speaking experience
• Completed delivery of a data security governance or personal information protection compliance program
• Track record leading a major regulatory inspection or large-scale security remediation program
• First-hand experience in IT operations development or cloud platform delivery
• Contribution to national industry or group-level standards

Additional Information :

By choice we are committed to a diverse workforce and are an equal opportunity employer. Robert Bosch welcomes and encourages applications from people with disabilities. Accommodations are available on request for candidates taking part in the selection process.

Remote Work :

No

Employment Type :

Full-time