Head of Cybersecurity Research and Offensive Security Full Time

HSBC

Join a digital first bank that’s powered by people.

Our technology team builds innovative digital solutions rapidly and at scale to deliver the next generation of banking services for our customers around the world. We have an entrepreneurial mindset. Our people work together, creating an agile, collaborative, and innovative culture.

Offensive Security provides an independent challenge to HSBC’s cybersecurity posture by bringing the attacker’s mindset to find and exploit vulnerabilities and to simulate real-world attacks. Through this, OffSec discover weaknesses across people, process, and technology, enabling the Firm to better understand its exposure to cybersecurity attacks and to drive a proactive approach to protect itself and to manage risk more effectively.

The Global Head of Offensive Security has oversight of all manual, SME-led security testing activities across HSBC, including Penetration Testing, Red Teaming, Security Research, and Crowd-sourced Security Testing. They are responsible for understanding the threats to HSBC and its customers, and to continuously evolve cybersecurity testing programmes to measure the Firm’s exposure to those threats. They must understand the demands of global regulators to ensure these testing programmes align to these requirements. They are also responsible for maintaining a forward-looking capability to identify new and emerging cybersecurity threats and provide guidance to the Firm on how best to protect itself for the future.

Job Requirements:

• Holding autonomy and accountability for a global team of circa 100 staff and an annual operating budget of approximately USD $20 million, reporting to the Group CISO.
• Develop the Offensive Security function, engaging with colleagues across Cybersecurity and other IT functions to drive and deliver sustainable plans in line with department strategy.
• Protect the organisation by ensuring processes are in place to proactively discover vulnerabilities and ensure transparency and influence of GB/GF/Market technology leadership’s risk management and related investment decisions.
• Make informed and educated risk decision making, considering risk-risk trade-offs. Make appropriate commercial / financial institution risk vs reward decisions.
• Drive business performance and appropriate and robust cyber risk management.
• Lead and develop the Offensive Security function, making sustainable decisions that protect and enhance HSBC’s values, reputation, and stakeholder value.
• Overall accountability for the global Offensive Security teams which deliver security testing programmes.
• Accountable for the delivery of security testing programmes (including penetration testing and red teaming) to meet the requirements of HSBC’s global regulators.
• Accountable for the budget and delivery of the change portfolio associated with the function.
• Global Control Ownership for VIAO.3 (Offensive Security) control and protecting the bank’s technology, information, and customers via:
  • Maintaining strategies and executing the continuous discovery of vulnerabilities across HSBC’s people, process, and technology, to inform effective risk management in-line with business strategies, risk appetites, regulatory expectations, best practice and against an evolving cyber-threat landscape.
  • Defining minimum standards and associated Control and KPI metrics covering all supported entities within HSBC Group.
  • Continuous review and assessment of KPI metrics and responding to results to intervene, adapt and support GB/GFs as necessary.
  • Ensuring Controls are effectively operated, delivering sustainable uplifts where required.
  • Ensure controls have sufficiently robust and transparent evidence demonstrating their efficacy, for consumption by HSBC GB/GFs, Boards, 2nd and 3rd Lines of Defence and regulators.
• Developing and maintaining a highly skilled and efficient global team of subject matter experts in offensive security testing, that focuses on continuous improvements of vulnerability discovery methodologies.