Cybersecurity Specialist

About the role

The Cybersecurity Specialist is the hands-on group focal point for cybersecurity operations, enterprise audit and certification management, information-security assurance, incident response and customer assurance. Reporting to the Head of IT, the role works across all group functions, legal entities and sites, and with Sales, technology teams, business leaders, auditors, certification bodies, customers and vendors. It owns and coordinates the group-wide audit and certification programme.

Key responsibilities

• Improve security monitoring across identity, endpoint, email, cloud, network and applications; track threat intelligence and maintain security dashboards.
• Coordinate vulnerability scanning, configuration reviews and identity controls (MFA, PAM, least privilege).
• Act as incident coordinator or technical lead, coordinate containment and recovery, run post-incident reviews and maintain BCP procedures.
• Own the group audit and certification programme: calendar, readiness, evidence and artefacts, and liaise with certification bodies, external auditors, regulators and customers.
• Support Sales, Account Management and Bid/Tender teams with ISO and cybersecurity requirements, RFP responses and due diligence.
• Review vendors, contracts and architectures, embed security gates in delivery lifecycles and deliver awareness, tabletop exercises and continuous improvement.

Required profile

• Degree in Cybersecurity, IT, Computer Science, Engineering or a related discipline, or equivalent experience.
• At least 4 years of hands-on experience in security operations, incident response, vulnerability management, GRC or security engineering.
• Experience in a multi-site or regional environment coordinating teams and managed security vendors.
• Fluent in written and spoken English and Chinese, able to brief executives and influence stakeholders in Chinese-speaking markets.

Required skills

• Identity/MFA/PAM, endpoint and email security, SIEM/XDR, vulnerability scanning, cloud and network security, logging and incident evidence.
• Practical understanding of ISO/IEC 27001, NIST CSF, CIS Controls or equivalent frameworks.
• Advantageous: Security+, SSCP, GCIH, CISSP, CISM, CRISC, ISO 27001 Lead Implementer/Auditor or cloud security certifications.