Analyst, IT Security Engineering, IT
Read straight from CITIC CLSA's careers page, verified 2d ago.Seekless can tailor your résumé to it.
Seekless can write your résumé for this posting first.
Before you apply
LocationHong Kong
Typefull-time
SeniorityMid
Experience3–5 yrs
Company size1,001–5,000 people
PostedJul 10, 2026 · 3mo ago
Verified live2d ago
May no longer be actively hiring
Posted by the company on Jul 10, 202658% of this company's open roles have been listed for 90+ days
At a glanceSummarised by Seekless from the posting.
Bachelor Degree or above in IT, Computer Science
3-5 years related experience in cybersecurity, with knowledge in regulatories
Hands-on experience with penetration test and vulnerability scanning tools such as Burp Suite, Metasploit, ZAP, Qualys, Tenable/Nessus, Nmap, etc
Strong communication skills in English and Chinese
Project management skills
Experience of offensive security services on Web, Network, Server, Client Apps, Mobile, AI, Internet of Thing (IOT) is required: Penetration testing, Security risk assessment/technical review, Configuration review, Vulnerability scanning and assessment
Knowledge and understanding of Microsoft 365 cloud services
Knowledge and understanding of Public Cloud computing platforms - Microsoft Azure, AWS, GCP, Ali Cloud, Tencent Cloud, etc
Knowledge and understanding of AI Tools/Models - OpenAI GPT, Anthropic Claude, Google Gemini, Microsoft Copilot, Amazon Bedrock, Grok
Knowledge and understanding of IP/Cisco Networking
Knowledge and understanding of Virtualization Technology
Knowledge and understanding of Microsoft Active Directory, Microsoft Certificate Authority, Microsoft Windows servers and Linux
Knowledge and understanding of Storage and Database fundamental
Preferably holds IT Security Certifications such as CISSP, CISA, CISM, etc. Certificates related to offensive security (e.g. OSCP, OSWP, OSEP or equivalent) are an advantage
Candidates with backgrounds in Big4, IT consultancy firms, or Cyber Threat Intelligence are welcome to apply
Knowledge of two or more of the following security areas: Web Application Firewalls (Akamai, Cloudflare, AWS WAF, Azure WAF), Web filtering, DDoS protection
Knowledge of two or more of the following security areas: Single Sign On/MFA (Microsoft Entra/Okta/Cisco Duo)
Knowledge of two or more of the following security areas: Malware Sandboxing, Microsoft Cloud PKI and Intune
Knowledge of two or more of the following security areas: Zero Trust Solution (Zscaler, Palo Alto Networks, Microsoft Entra Private Access)
Skills
Burp Suite
Metasploit
ZAP
Qualys
Tenable/Nessus
Nmap
Microsoft 365
Microsoft Azure
AWS
GCP
Ali Cloud
Tencent Cloud
OpenAI GPT
Anthropic Claude
Google Gemini
Microsoft Copilot
Amazon Bedrock
Grok
Cisco Networking
Microsoft Active Directory
Microsoft Certificate Authority
Microsoft Windows servers
Linux
Akamai
Cloudflare
AWS WAF
Azure WAF
Microsoft Entra
Okta
Cisco Duo
Microsoft Cloud PKI
Intune
Zscaler
Palo Alto Networks
Microsoft Entra Private Access
Position Description
We are looking for an IT Security Analyst who is proactive, self-motivate, willing- to-do attitude to be part of an international IT Security team to engineer and support security solutions.
As a team member in IT security team, you will be a contributor to the company’s IT and Cyber security strategy and operations. You and your team will be managing a portfolio of IT security tools in identity access management, network intrusion detection system, endpoint protection, email security, data leakage protection, application security, and other information security controls.
Key Areas of Responsibilities
•
Conduct penetration testing, vulnerability scanning and code review on different IT systems and technologies
•
Perform architecture Review and security assessments on IT systems’ design, configuration, source code review on both On-Perm and Cloud
•
Conduct Cyber-attack simulation using red team / blue team / purple team exercises
•
Prepare and review reports on identified security vulnerabilities and possible recommendations to remediate the vulnerabilities
•
Perform access review for vendor and guest access on IT systems and services.
•
Assist on Evaluating, Design, planning and implementing IT security solutions, such as Web Application Firewalls, Single Sign On/MFA, Biometric authentication, Cloud Based Public Key Infrastructure (PKI), Malware Sandboxing, AI red teaming, Zero Trust Solutions, etc.
•
Assist on first and second level support for some of IT security controls and tools including penetration test tools, vulnerability scanning tools, etc.
•
Be the subject matter expert for some of the IT Security tools.
•
Build and maintain an effective working relationship with the team’s key stakeholders - IT Security team members, IT teams and business teams.
•
Design and deliver new strategic security initiatives with collaboration from business partners.
•
Maintain an Up-to-date understanding of the latest threats, vulnerabilities, mitigation and industry best practices, Post Quantum Computing standard (ML-KEM, ML-DSA, SLA-DSA), and developments in Artificial Intelligence.
Requirements
•
Bachelor Degree of above in IT, Computer Science
•
3-5 years related experience in cybersecurity, with knowledge in regulatories
•
Preferably holds IT Security Certifications such as CISSP, CISA, CISM, etc. Certificates related to offensive security (e.g. OSCP, OSWP, OSEP or equivalent) are an advantage.
•
Candidates with backgrounds in Big4, IT consultancy firms, or Cyber Threat Intelligence are welcome to apply
•
Hands-on experience with penetration test and vulnerability scanning tools such as Burp Suite, Metasploit, ZAP, Qualys, Tenable/Nessus, Nmap, etc
•
Strong communication skills in English and Chinese, as well as project management skills
•
Experience of offensive security services on Web, Network, Server, Client Apps, Mobile, AI, Internet of Thing (IOT) is required:
•
Penetration testing
•
Security risk assessment/technical review
•
Configuration review
•
Vulnerability scanning and assessment
•
Knowledge and understanding of the following areas are the foundation to succeed on this role:
•
Microsoft 365 cloud services – e.g. Exchange online, Sharepoint, OneDrive, Teams, etc
•
Public Cloud computing platforms - Microsoft Azure, AWS, GCP, Ali Cloud, Tencent Cloud, etc
•
AI Tools/Models - OpenAI GPT, Anthropic Claude, Google Gemini, Microsoft Copilot, Amazon Bedrock, Grok
•
IP/Cisco Networking
•
Virtualization Technology
•
Microsoft Active Directory, Microsoft Certificate Authority, Microsoft Windows servers and Linux
•
Storage and Database fundamental
Nice to have
Good-to-have
•
Knowledge of two or more of the following security areas below is a plus:
•
Web Application Firewalls (Akamai, Cloudflare, AWS WAF, Azure WAF), Web filtering, DDoS protection
•
Single Sign On/MFA (Microsoft Entra/Okta/Cisco Duo)
•
Malware Sandboxing, Microsoft Cloud PKI and Intune
•
Zero Trust Solution (Zscaler, Palo Alto Networks, Microsoft Entra Private Access)
Stay informed on CITIC CLSA Job Opportunities
Not the right fit? You can create a job alert to receive our latest job openings that meet your interest.