Security Auditor - Global Fintech Startup
Crypto.com, Hong Kong
Job Description
About Crypto.com
Crypto.com was founded in 2016 on a simple belief: it's a basic human right for everyone to control their money, data and identity. With over 10 million users on its platform today, Crypto.com provides a powerful alternative to traditional financial services, turning its vision of "cryptocurrency in every wallet" into reality, one customer at a time. Crypto.com is built on a solid foundation of security, privacy and compliance and is the first cryptocurrency company in the world to have CCSS Level 3, ISO/IEC 27001:2013, ISO/IEC 27701:2019, and PCI:DSS Level 1 Service Provider compliance, as well as NIST CSF amp; PF Tier 4 maturity. Crypto.com is headquartered in Hong Kong with a 900+ strong team.
For more information, please visit www.crypto.com.
Hong Kong is the headquarters of the Information Security function led by our industry-leading Chief Information Security Officer (CISO).
As our Security Auditor, you will be tasked with security audit activities along with our journey. You are expected to take the initiative to assist us on several security compliance programs and certifications. You are required to conduct annual and on-demand audits of our security and privacy governance, review our risk and compliance control effectiveness, and give recommendations and support on our remediation activities. You will also be trusted to provide technical advice to ensure that our security and privacy policies are enforced throughout all business units.
Job Responsibilities
- Manage IT infrastructure and application audits from planning to reporting and closing of audit issues
- Involve in IT governance reviews and technical assessments, and recommend internal control improvements
- Provide consultancy advice on IT management and security
- Enhance audit process and proficiency through implementing audit standards, methodologies, and techniques
- Take up ad-hoc projects as required
Requirements
Qualifications
- Experience in information security, IT audit or IT risk management related roles.
- Experience with one or more of the following: conducting security control assessments, risk assessments or audits preferred.
- Prefer experience with any of the following: PCI-DSS, SOC2, NIST cybersecurity and privacy frameworks, ISO 27001/27701 security standards, and data protection regulations and requirements.
- Holders of security related certifications/qualifications will be an added advantage (CISSP, CGEIT, CRISC, CISM, CISA, CIPP, etc)
- ISO 27001 Internal Auditor / Lead Auditor certification (or similar) preferred
- Experience with GDPR preferred; interested to enter into the data privacy field
- Minimum 2-3 years of hands-on experience in a fast paced working environment and APAC regions is preferred
You are also expected to:
- Demonstrate a strong commitment to personal learning and development
- Detail minded with an analytical mindset
- Good communication skills with an ability to explain complex technical issues to non-technical business users
- Proficiency in both spoken and written English