Project Manager (C34400)

Project Nature:

• IT projects and on-going support Auxiliary Medical Service (AMS) and Civil Aid Service (CAS).

Responsibilities:

Serve a contract assignment under InfoTech's headcount, full-time second to serve Security Bureau;

(A) Design, implementation and operations of IT security controls including the more stringent security controls for Tier 2 and Tier 3 systems as specified in Appendix C of the IT Security Guidelines (G3) :-

• Establish IT security organisation including the information security steering committee and the IT security management unit, hold regular meetings, prepare necessary documents and follow up outstanding issues.

• Formulate IT security management framework including the risk registers to document identified risks, likelihood and severity of occurrence, and mitigation and monitoring measures.

• Establish IT security threat management mechanism for threat identification, detection, monitoring and response.

• Formulate IT security training programme for all personnel involved in support and operations of IT systems, and formulate and enforce contractual obligation with outsourced contractors.

• Spell out, monitor and ensure necessary IT security controls are in place and functional throughout system development life-cycle and on-going system operations, in particular in the areas of access control, operations security, system acquisition / development / maintenance, business continuity, etc. Assist in user acceptance planning and execution in IT security perspectives. Ensure quality procedures, techniques and tools are used.

• Review system development deliverables, documentation and operating procedures, identify IT security shortfalls and recommend improvements.

• Bring up, drive and ensure on-time completion of compliance work including IT security risk assessment and audit, privacy impact assessments, vulnerability scanning, penetration tests, configuration review, code scanning, regular review on usage of privileged accounts, etc.

• Formulate and maintain information security incident response plans, take lead to respond to IT security incidents.

• Prepare and maintain documents and ensure timely submission to DPO for compliance monitoring and audit.

(B) IT project management

• Take lead and be responsible for IT security aspects of multiple system development projects and IT infrastructure enhancement projects within a tight project timeline. Serve as the focal point to all levels of users and multiple contractors regarding IT security related matters.

• Drive and monitor project progress, manage issues and delay and escalate to management when necessary, review and supplement system design, examine quality of deliverables, ensure the projects are delivered on time and meet user requirements and government IT standards.

• Elicit and analyse user requirements, convert business process into technical requirements, prepare specifications for procurement of IT equipment and outsourced services.

• Plan, participate and control all phases of projects including systems analysis and design, procurement and installation, implementation, system and user acceptance testing, production rollout, system nursing and maintenance.

• Conduct regular assessment, review and risk management of the projects, proactively alert potential project risks and issues to projects team members.

(C) Carry out any other IT related tasks assigned by the supervisor.

Requirements:

• Bachelor's degree holder in Computer Science, Information Technology or equivalent.

• Possess at least one of the industry recognised IT security certification (e.g. CISA, CISSP, CISP, etc) is required; at least 5 years' experience in Information Security Management, IT Security; knowledge of managing corporate IT security framework;

• Experience in compliance of government IT security policies and guidelines, IT security risk management and threat management (e.g. S17, G3, Security Risk Assessment and Audit (SRAA), and Privacy Impact Assessment (PIA)) is required; at least 3 years' experience in SRAA;

• Experience in managing outsourced IT security and network enhancement projects, from requirement study, system design, implementation, to testing and deployment is required; at least 5 years' experience in network design, network and system management; Knowledge of endpoint security solutions is an advantage;

• Strong communication and liaison skills with multiple user groups and contractors, experience in eliciting, analyzing, and documenting user requirements, as well as planning and coordinating larger-scale user acceptance and production rollout are required;

• Experience in managing government IT projects and preparing general project deliverables (e.g. SA&D report, project schedule, resources plan, project progress report, UAT plan, production rollout plan, etc.) is required. Experience in preparing project deliverables in government formats (e.g. Project Management Plan, Project Initiation Document, PIDR, Project Highlight Report, Quality Assurance Report, etc.) is preferred.

• Experience in government IT product and service procurement is preferred; Knowledge of IT procurement is an advantage;

• Experience in Xinchuang (XC) products and solutions is preferred.

• Project management certification (e.g. PRINCE2, PMP) is preferred.

• Overtime and on-call outside office hour are required when necessary,

• Independent, self-motivated and good sense of responsibility; and

• Pleasant personality and good interpersonal skills.

Please apply by email or WhatsApp by quoting Job Title with InfoTech's Job Key No (one alphabet prefix with up to five digits) as subject.  You may directly apply online for this post at https://www.infotech.com.hk/itjs/job/fe-view.do?method=feView&jjKey=34400 

The information provided will be treated in strict confidence and be used only for consideration of your application for relevant / similar posts within the Group/ Company.