Technical Manager, Vulnerability Management (Penetration Testing)

The Hong Kong Jockey Club

Founded in 1884, The Hong Kong Jockey Club (“the Club”) is a world-class racing club that acts continuously for the betterment of our society. The Club has a unique integrated business model, comprising racing and racecourse entertainment, a membership club, responsible sports wagering and lottery, and charities and community contribution. Through this model, the Club generates economic and social value for the community and supports the HKSAR Government in combatting illegal gambling.

Who are we?

We are the IT Division of HKJC, a vibrant community of over 1,500 dedicated professionals working collaboratively across Hong Kong and Shenzhen.

Our team is a diverse mix of individuals from various backgrounds, from all across the world. We embrace our humanity, recognizing that each of us brings unique strengths and perspectives. This diversity not only enriches our work environment but also drives our innovation and creativity as we strive to achieve our collective goals.

What do we do?

We design, build, and operate the technology that powers the Club. Our primary focus is on delivering the service that supports our hospitality, racing and wagering operations, to ensure that our customers and members enjoy exceptional experiences.

We also deliver the changes necessary to drive business growth through new products and services. And, we are committed to safeguarding the Club by protecting it from external threats, providing a secure and resilient technological environment.

The Department

The Cyber Security Department is essential to the Club’s ongoing success, safeguarding information assets, IT systems, networks, and cloud platforms while ensuring the resilience and continuity of critical operations. Through the implementation of strong risk governance frameworks and cybersecurity standards, the department protects the Club against emerging threats and ensures compliance with regulatory requirements in Hong Kong and China.

As the first line of defense, the department plays a key role in maintaining the Club’s reputation and operational resilience. Its core responsibilities include identifying and addressing vulnerabilities, protecting sensitive information, ensuring rapid incident response, overseeing access management, and promoting Club-wide cybersecurity awareness.

The Job

• Perform penetration testing and vulnerability assessment activities across applications, systems, and infrastructure to identify security weaknesses and support their remediation
• Support penetration testing requests by working with project teams and stakeholders to understand requirements, testing scope, and expected deliverables
• Conduct security testing and vulnerability assessments, including:
  • System and infrastructure security reviews
  • Web application penetration testing
  • Mobile application security testing
  • Vulnerability scanning and prioritisation
• Identify, validate, and, where appropriate, exploit vulnerabilities using manual testing techniques and automated security tools
• Develop and maintain scripts, payloads, and testing utilities to support penetration testing and improve testing efficiency
• Prepare clear and accurate technical reports, documenting findings, supporting evidence, risk impact, and recommended remediation actions in accordance with organisational cybersecurity standards
• Work with relevant stakeholders to communicate findings, clarify remediation requirements, and follow up on the progress and closure of identified vulnerabilities. Maintain dashboards, metrics, and KRIs to support monitoring of cybersecurity posture, vulnerability remediation, and regular management reporting
• Contribute to the maintenance and continuous improvement of penetration testing and vulnerability management procedures, methodologies, standards, and documentation
• Coordinate with external security testing vendors where required, supporting service delivery and monitoring activities against agreed requirements and SLAs
• Work collaboratively with team members and other technology teams, share technical knowledge, and contribute to a positive and inclusive team culture

About You

• Bachelor’s and/or Postgraduate degree from a highly accredited university in the discipline of Computer Science, Information Technology, Software Engineering, Cyber Security, or a similar field
• Industry-recognised certification in one or more of the following – OSCP, OSCE, OSWE, GPEN, CEH, CISSP, CISM, or equivalent
• 5 years or more of working experience in the penetration testing and vulnerability management domain across various disciplines
• Hands-on experience with industry-standard tools such as Kali Linux, Burp Suite, Qualys, Nessus, Nmap, Metasploit, Wireshark, etc.
• Deep technical knowledge in:
  • Operating systems: Windows, Linux, macOS
  • Offensive tooling and techniques: Implant reverse shells, Command and Control (C2) infrastructure
  • Network and security architecture: TCP/IP, IDS/IPS, firewalls, WAFs, web content filtering
  • Cloud platform: Integrated security solutions across major cloud providers (e.g. AWS, Azure)
  • Application security: Coding practices and architecture design
• Demonstrated ability to perform penetration testing, vulnerability assessments, and security reviews for applications and infrastructure
• Contribute to the development and refinement of penetration testing and secure vulnerability management standards
• Experience participating in red team operations is desired
• Exploit research and development skills are a plus
• Source code review experience is a plus
• Proven expertise in conducting application security assessments across web, mobile, and self-developed applications
• Strong service and a customer-focused approach to the service being delivered
• Excellent interpersonal, collaborative and communication skills
• Well-disciplined with exemplary professional competence and integrity

Apply Now!

We offer competitive salary and benefits packages, a dynamic working environment and development opportunities.

Add horsepower to your career today. Click the “Apply Now” button to create an account and submit your application.

Equal Opportunity and Inclusive Hiring

We are an equal opportunity employer and strive to create an inclusive workplace for all. Applicants from diverse backgrounds are welcomed to apply. If you have any special needs or require accommodations during the interview process, please e-mail us via careers@hkjc.org.hk. Personal data provided by job applicants will be used strictly in accordance with the Club's notice to employees and job applicants relating to the Personal Data (Privacy) Ordinance. A copy of which will be provided immediately upon request.