Working Location: Kai Tak, Kowloon, Hong Kong
Employment Duration: Permanent
The Senior Red Team Manager is responsible for ensuring that CLP Group continues to improve its cyber resilience through real-world Red Team exercises. These exercises are perhaps one of the most critical aspects contributing to improving CLP Group’s Cyber defenses. They help to improve detection and response capabilities, in order to minimise business impact, financial loss and protect the CLP Brand.
Key Responsibilities
- As a key member of the Assurance Team reporting to the Head of Technical Assurance & Penetration Testing, assist in developing a program of offensive campaigns to test CLP Group’s cyber detective and protective controls. This aims to improve the Groups’ defensive capabilities.
- Drive innovative thinking by researching and testing new tools and techniques to identify vulnerabilities and weaknesses in the people, processes and technologies that combine to provide CLP Group’s cyber detective and protective controls.
- Provide the Group with reports that contain the necessary insight to support security fixes, patches, remediation, and training to ensure the same opportunities for exploitation do not exist in the future.
- Produce regular reports and assist with creating both technical and non-technical presentations for senior management.
- Perform quality assurance for Red Team reports and other management-level material.
- Stay current with emerging security threats, vulnerabilities, and share knowledge with other security team members.
- Work with development teams and security personnel to help prioritize and remediate identified vulnerabilities.
Qualifications & Experience
- Bachelor's degree in Computer Science, Information Technology, or a related field.
- 6+ years of cybersecurity experience, including 4 years performing Red Team exercises.
- Independent management experience covering Red Team exercises, penetration testing, including project planning, scoping, and quality assurance.
- Strong understanding of network security, web application security, API security, and mobile application security.
- Experience with Microsoft enterprise technologies including but not limited to Windows, Active Directory, TMG, IIS etc.; Open source technologies such as Linux; virtualization technologies such as VMware and Hyper-V; and hands-on experience in TCP/IP networking, firewalls, VPN, intrusion prevention systems, network security monitoring, network vulnerability scanning.
- Experience performing both manual and automated penetration testing, using tools such as Burp Suite, Metasploit, and Nmap.
- Knowledge of scripting languages such as Python, Ruby, or PowerShell.
- Excellent written and verbal communication skills, including the ability to gather and critically evaluate information and prepare written documents that clearly and concisely identify the issues presented and their proposed resolution.
- Ability to explain technical issues to non-technical stakeholders.
- Good command of spoken and written English.
- Embraces new ideas and approaches and be willing to learn and adapt to evolving technologies.
- Actively shares technical knowledge and insights with team members to foster a collaborative environment.
- Ability to work collaboratively with cross-functional teams.
- Independent research experience performing vulnerability research and exploitation is a plus.
- Candidate should hold a relevant Red Team certification (such as CRTO/CRTE/PACES).
- Holds relevant penetration testing certification such as OSCP/OSCE.
- Experience with Operational Technology related applications and systems is a plus.
About Clp
CLP was founded in Hong Kong in 1901, at a time when electricity was still a novelty worldwide. Today we power millions of homes and businesses across the Asia-Pacific region with over 8,000 employees. In Hong Kong, we operate a vertically integrated electricity business providing a highly reliable supply of electricity to over 80% of the city’s population. Outside Hong Kong, we invest in the energy sector on the Chinese Mainland, in Australia, India, Taiwan Region and Thailand. Our business spans the electricity value chain ranging from power generation, transmission and distribution to retail and smart energy services. We have a diversified portfolio of generating assets that uses a wide range of fuels sources including nuclear, renewables, gas and coal. To meet the evolving needs of energy users in a world being reshaped by decarbonisation and digitalisation, we strive to embrace new opportunities and expand our horizons as we fulfil our purpose to Power Brighter Tomorrows.
