Technical Manager, Security Architecture

Sits within the Club's AOP programme, a strategic mission to transform digital capabilities across product, technology, operations, delivery and change. It focuses on cybersecurity engineering across security as code, GitOps, SIEM/SOAR operations, CI/CD security pipelines, enterprise secrets and privileged access management, PKI, and compliance automation. The team is diverse and passionate about solving complex challenges, delivering meaningful impact, and creating value for customers, members, the Club and the wider community.

• Design secure GitOps workflows using Argo CD with security policy enforcement, automated security testing, and compliance validation integrated into deployment pipelines.
• Create self-service secure Environment on Demand capabilities with automated security baseline configurations, policy enforcement, and threat detection
• Establish security configuration drift detection and automated remediation
• Implement security policy templates and reusable modules for rapid deployment of compliant environments with embedded security controls.
• Configure and maintain Datadog Security Monitoring platform for comprehensive threat detection with automated log aggregation from all AWS services
• Design custom security dashboards, correlation rules for APT detection, and machine learning-based anomaly detection for unusual access patterns and insider threats.
• Implement Security Orchestration and Automated Response (SOAR) with automated incident response playbooks, threat containment, and evidence collection
• Create automated threat intelligence integration, vulnerability assessment, and security incident escalation workflows integrated with JIRA Service Management
• Design threat hunting workflows, behavioural analytics for privileged accounts, and multi-stage attack detection with kill chain analysis.
• Design comprehensive security scanning pipelines in CloudBees CI integrating SAST, DAST, container scanning, and secrets detection; implement Software Composition Analysis (SCA) with Snyk and JFrog integration for dependency vulnerability management and automated remediation.
• Create security quality gates at each SDLC phase with automated security code review, threat modelling validation, and penetration testing integration
• Design compliance validation pipelines for SOC 2, ISO 27001, GDPR, and PDPO regulatory requirements with automated audit evidence collection
• Implement security chaos engineering and resilience testing integration with security incident response automation.
• Design enterprise-grade secrets management architecture using AWS Secrets Manager and HashiCorp Vault with automated rotation policies and cross-environment secrets sharing
• Implement Privileged Access Management (PAM) with just-in-time (JIT) access, privileged session monitoring, and break-glass emergency access procedures.
• Create comprehensive secrets discovery, inventory management, and compliance monitoring with automated secrets scanning in code repositories
• Design privileged access analytics, risk assessment, and automated compliance reporting for audit and governance
• Implement secrets integration with CI/CD/CT pipelines and GitOps workflows ensuring secure credential distribution to Environment on Demand provisioning.
• Design and implement automated certificate lifecycle management with comprehensive discovery, provisioning, renewal, and rotation procedures
• Create private PKI infrastructure for internal services with automated private certificate issuance and AWS Certificate Manager integration
• Implement certificate compliance monitoring, expiration alerting, and backup/disaster recovery procedures as code.
• Design enterprise-wide PKI strategy with certificate authority hierarchy, trust relationships, and certificate policy enforcement; create certificate performance monitoring, audit trail documentation, and training programs for certificate adoption.
• Design zero-trust architecture patterns for AWS environments with secure multi-account architecture, microservices security, and serverless security patterns; implement Open Policy Agent (OPA) and Kyverno policies for Kubernetes security governance and container security compliance.
• Create automated compliance monitoring using AWS Config rules, Security Hub integration, and continuous security validation with exception tracking
• Design secure integration patterns for third-party products with security controls, monitoring, and incident response procedures
• Implement security risk assessment automation, vendor security evaluation, and procurement security review processes.

• 5+ years of cybersecurity engineering experience with cloud security and automation.
• 3+ years of AWS security services experience and cloud-native security architecture.
• 3+ years of Security as Code implementation using Infrastructure as Code tools (Terraform).
• 2+ years of SIEM/SOAR operations and automated incident response experience.
• Experience with container security, Kubernetes security policies, and DevSecOps practices.
• Knowledge of compliance frameworks, audit requirements, and regulatory security standards.
• SIEM/SOAR: Datadog Security Monitoring, AWS Security Hub, GuardDuty integration, and automated incident response.
• Container Security: NeuVector, Falco, OPA/Kyverno policy enforcement, and Kubernetes security patterns.
• GitOps Security: Argo CD security integration, secure Git workflows, and security policy enforcement in deployment pipelines.
• Programming: Python, TypeScript, Bash scripting for security automation and integration development.
• AWS Security: IAM, Secrets Manager, Security Hub, Config, CloudTrail, GuardDuty, WAF, and VPC security.
• Identity Management: AWS SSO, Azure Entra ID, SAML/OIDC federation, and privileged access management.
• Compliance Frameworks: SOC 2, ISO 27001, GDPR, PDPO and automated compliance validation.
• PKI & Certificates: AWS Certificate Manager, Private CA, HashiCorp Vault PKI, and automated certificate management.
• Security Scanning: SAST (SonarQube, JFrog, Snyk, Datadog), DAST (OWASP ZAP, Snyk, Datadog), SCA (Snyk, JFrog), container scanning (Trivy), and secrets detection.

• Competitive salary and benefits package.

• Dynamic working environment.
• Development opportunities.

The Club is Hong Kong's largest single taxpayer and one of the city's major employers, and its Charities Trust is one of the world's leading charity donors. We are an equal opportunity employer and strive to create an inclusive workplace for all.