Technical Manager, Security Architecture

The Hong Kong Jockey Club

Founded in 1884, The Hong Kong Jockey Club ("the Club") is a world-class horse sports and entertainment organisation that acts continuously for the betterment of our society. The Club has a unique value creation model, through which the Club generates sustainable economic and social value for the benefit of the community and supports the HKSAR Government in combatting illegal gambling.  The Club is Hong Kong’s largest single taxpayer and one of the city’s major employers. Its Charities Trust is one of the world’s leading charity donors.

The Department

Join us as we shape the future of sports and entertainment at the Club through a strategic mission to transform our digital capabilities. Our flagship programme, operating under the internal acronym ‘AOP’, aims to Accelerate our Platform, Product, People, Performance and Potential, bringing this strategy to life through innovation and delivery excellence.

AOP's work spans product, technology, operations, delivery and change, creating next-generation experiences and strengthening the capabilities that support the Club's future growth. We are a diverse team passionate about solving complex challenges, delivering meaningful impact, and creating value for customers, members, the Club and the wider community.

The Job

• Security as Code & GitOps Implementation
  • Design secure GitOps workflows using Argo CD with security policy enforcement, automated security testing, and compliance validation integrated into deployment pipelines
  • Create self-service secure Environment on Demand capabilities with automated security baseline configurations, policy enforcement, and threat detection for all provisioned environments
  • Establish security configuration drift detection and automated remediation, ensuring consistent security posture across allGitOps-managed environments
  • Implement security policy templates and reusable modules for rapid deployment of compliant environments with embedded security controls
• Advanced SIEM/SOAR Operations & Threat Detection
  • Configure and maintain Datadog Security Monitoring platform for comprehensive threat detection with automated log aggregation from all AWS services (CloudTrail, GuardDuty, etc)
  • Design custom security dashboards, correlation rules for APT detection, and machine learning-based anomaly detection for unusual access patterns and insider threats
  • Implement Security Orchestration and Automated Response (SOAR) with automated incident response playbooks, threat containment, and evidence collection procedures
  • Create automated threat intelligence integration, vulnerability assessment, and security incident escalation workflows within integration to JIRA Service Management
  • Design threat hunting workflows, behavioural analytics for privileged accounts, and multi-stage attack detection with kill chain analysis
• CI/CD Security Pipeline Architecture
  • Design comprehensive security scanning pipelines in CloudBees CI integrating SAST (SonarQube Cloud, Snyk, Datadog), DAST (OWASP ZAP, Snyk, Datadog), container scanning (Trivy, NeuVector, Snyk), and secrets detection (GitHub Advanced Security, GitLeaks)
  • Implement Software Composition Analysis (SCA) with Snyk and JFrog integration for dependency vulnerability management and automated remediation
  • Create security quality gates at each SDLC phase with automated security code review, threat modelling validation, and penetration testing integration
  • Design compliance validation pipelines for SOC 2, ISO 27001, GDPR, and PDPO regulatory requirements with automated audit evidence collection
  • Implement security chaos engineering and resilience testing integration with security incident response automation
• Enterprise Secrets & Privilege Access Management
  • Design enterprise-grade secrets management architecture using AWS Secrets Manager and HashiCorp Vault with automated rotation policies and cross-environment secrets sharing
  • Implement Privileged Access Management (PAM) with just-in-time (JIT) access, privileged session monitoring, and break-glass emergency access procedures
  • Create comprehensive secrets discovery, inventory management, and compliance monitoring with automated secrets scanning in code repositories
  • Design privileged access analytics, risk assessment, and automated compliance reporting for audit and governance requirements
  • Implement secrets integration with CI/CD/CT pipelines and GitOps workflows ensuring secure credential distribution to Environment on Demand provisioning

Technical Skills

• Certificate Management & PKI Infrastructure
  • Design and implement automated certificate lifecycle management with comprehensive discovery, provisioning, renewal, and rotation procedures
  • Create private PKI infrastructure for internal services with automated private certificate issuance and AWS Certificate Manager integration
  • Implement certificate compliance monitoring, expiration alerting, and backup/disaster recovery procedures as code
  • Design enterprise-wide PKI strategy with certificate authority hierarchy, trust relationships, and certificate policy enforcement
  • Create certificate performance monitoring, audit trail documentation, and training programs for certificate adoption
• Security Architecture & Compliance Automation
  • Design zero-trust architecture patterns for AWS environments with secure multi-account architecture, microservices security,and serverless security patterns
  • Implement Open Policy Agent (OPA) and Kyverno policies for Kubernetes security governance and container security compliance
  • Create automated compliance monitoring using AWS Config rules, Security Hub integration, and continuous security validation with exception tracking
  • Design secure integration patterns for third-party products with security controls, monitoring, and incident response procedures
  • Implement security risk assessment automation, vendor security evaluation, and procurement security review processes

About You

• 5+ years of cybersecurity engineering experience with cloud security and automation
• 3+ years of AWS security services experience and cloud-native security architecture
• 3+ years of Security as Code implementation using Infrastructure as Code tools (Terraform)
• 2+ years of SIEM/SOAR operations and automated incident response experience
• Experience with container security, Kubernetes security policies, and DevSecOps practices
• Knowledge of compliance frameworks, audit requirements, and regulatory security standards
• Required Technical Skills
  • SIEM/SOAR: Datadog Security Monitoring, AWS Security Hub, GuardDuty integration, and automated incident response
  • Container Security: NeuVector, Falco, OPA/Kyverno policy enforcement, and Kubernetes security patterns
  • GitOps Security: Argo CD security integration, secure Git workflows, and security policy enforcement in deployment pipelines
  • Programming: Python, TypeScript, Bash scripting for security automation and integration development
  • AWS Security: IAM, Secrets Manager, Security Hub, Config, CloudTrail, GuardDuty, WAF, and VPC security
  • Identity Management: AWS SSO, Azure Entra ID, SAML/OIDC federation, and privileged access management
  • Compliance Frameworks: SOC 2, ISO 27001, GDPR, PDPO and automated compliance validation
  • PKI & Certificates: AWS Certificate Manager, Private CA, HashiCorp Vault PKI, and automated certificate management
  • Security Scanning: SAST (SonarQube, JFrog, Snyk, Datadog), DAST (OWASP ZAP, Snyk, Datadog), SCA (Snyk, JFrog), container scanning (Trivy), and secrets detection
  • Penetration Testing: Metasploit, Burp Suite, Nmap, Prowler for automated penetration testing, and security validation frameworks
  • Chaos Engineering: Gremlin, Chaos Toolkit, LitmusChaos for security resilience testing and failure injection
  • Threat Detection: Machine learning-based anomaly detection, behavioural analytics, and threat intelligence integration

Apply Now!

We offer competitive salary and benefits packages, a dynamic working environment and development opportunities.

Add horsepower to your career today. If you do not meet all of the requirements but still believe you can make a difference, please apply.

Equal Opportunity and Inclusive Hiring

We are an equal opportunity employer and strive to create an inclusive workplace for all. Applicants from diverse backgrounds are welcomed to apply. If you have any special needs or require accommodations during the interview process, please e-mail us via careers@hkjc.org.hk. Personal data provided by job applicants will be used strictly in accordance with the Club's notice to employees and job applicants relating to the Personal Data (Privacy) Ordinance. A copy of which will be provided immediately upon request.