Technical Manager, Vulnerability Management (Penetration Testing)

Sits within the Cyber Security Department of the Club's IT Division, which safeguards information assets, IT systems, networks, and cloud platforms while ensuring the resilience and continuity of critical operations. As the first line of defence, the department identifies and addresses vulnerabilities, protects sensitive information, supports rapid incident response, oversees access management, and promotes Club-wide cybersecurity awareness. The post-holder performs penetration testing and vulnerability assessment across applications, systems, and infrastructure, and works with project teams, stakeholders, and external testing vendors to drive the remediation of identified weaknesses.

• Perform penetration testing and vulnerability assessment activities across applications, systems, and infrastructure to identify security weaknesses and support their remediation.
• Support penetration testing requests by working with project teams and stakeholders to understand requirements, testing scope, and expected deliverables.
• Conduct security testing and vulnerability assessments, including system and infrastructure security reviews, web application penetration testing, mobile application security testing, and vulnerability scanning and prioritisation.
• Identify, validate, and, where appropriate, exploit vulnerabilities using manual testing techniques and automated security tools.
• Develop and maintain scripts, payloads, and testing utilities to support penetration testing and improve testing efficiency.
• Prepare clear and accurate technical reports documenting findings, supporting evidence, risk impact, and recommended remediation actions in accordance with organisational cybersecurity standards.
• Communicate findings to relevant stakeholders, clarify remediation requirements, and follow up on the progress and closure of identified vulnerabilities.
• Maintain dashboards, metrics, and KRIs to support monitoring of cybersecurity posture, vulnerability remediation, and regular management reporting.
• Contribute to the maintenance and continuous improvement of penetration testing and vulnerability management procedures, methodologies, standards, and documentation.
• Coordinate with external security testing vendors where required, supporting service delivery and monitoring activities against agreed requirements and SLAs.
• Work collaboratively with team members and other technology teams, sharing technical knowledge and contributing to a positive and inclusive team culture.

• Bachelor's and/or postgraduate degree from a highly accredited university in Computer Science, Information Technology, Software Engineering, Cyber Security, or a similar field.
• Industry-recognised certification in one or more of OSCP, OSCE, OSWE, GPEN, CEH, CISSP, CISM, or equivalent.
• Five years or more of working experience in the penetration testing and vulnerability management domain across various disciplines.
• Hands-on experience with industry-standard tools such as Kali Linux, Burp Suite, Qualys, Nessus, Nmap, Metasploit, and Wireshark.
• Deep technical knowledge of operating systems, including Windows, Linux, and macOS.
• Deep technical knowledge of offensive tooling and techniques, including implant reverse shells and Command and Control (C2) infrastructure.
• Deep technical knowledge of network and security architecture, including TCP/IP, IDS/IPS, firewalls, WAFs, and web content filtering.
• Deep technical knowledge of integrated security solutions across major cloud providers such as AWS and Azure.
• Deep technical knowledge of application security, including coding practices and architecture design.
• Demonstrated ability to perform penetration testing, vulnerability assessments, and security reviews for applications and infrastructure.
• Ability to contribute to the development and refinement of penetration testing and secure vulnerability management standards.
• Proven expertise in conducting application security assessments across web, mobile, and self-developed applications.
• Strong service and customer-focused approach to the service being delivered.
• Excellent interpersonal, collaborative, and communication skills.
• Well-disciplined with exemplary professional competence and integrity.

• Experience participating in red team operations is desired.
• Exploit research and development skills are a plus.
• Source code review experience is a plus.

• Competitive salary and benefits packages.
• A dynamic working environment.
• Development opportunities.

We are the IT Division of HKJC, a vibrant community of over 1,500 dedicated professionals working collaboratively across Hong Kong and Shenzhen, and we design, build, and operate the technology that powers the Club. We are an equal opportunity employer and strive to create an inclusive workplace for all, welcoming applicants from diverse backgrounds.