Tech Governance - Security Compliance & Governance Engineer (Mandarin Bilingual Required)

As a Security Compliance & Governance Engineer in OKX's Tech Governance Office, you combine the governance judgment of a seasoned compliance professional with the drive of a forward-deployed engineer. You own complex cross-functional work streams independently, coordinating across Engineering, Legal, Product, and Finance while managing external auditors and regulators. This role demands startup velocity paired with financial institution rigor, navigating ambiguity without hand-holding and operating with the urgency of a startup and the rigor of a regulated financial institution. Strong written and verbal communication in both English and Mandarin is a meaningful advantage.

What you'll do

• Independently lead audit remediation programs, assessing gaps, developing structured plans, and driving verified closure across engineering, product, legal, and operations without escalation dependency
• Own cross-functional governance work streams, setting milestones, coordinating accountability, and removing blockers across departments with limited management oversight
• Conduct IT security and architecture governance reviews to assess whether systems and processes meet applicable standards, and issue findings with clear ownership and remediation timelines
• Build and maintain the policy estate by drafting, refining, and operationalizing IT governance policies and procedures; translate regulatory requirements into implementation-ready guidance for first-line teams
• Lead regulator and auditor engagement as the primary coordination interface for external audit and regulatory correspondence, representing the Tech Governance Office with credibility and precision
• Deploy AI to accelerate compliance operations by prototyping and scaling AI-assisted workflows for evidence collection, control monitoring, audit response, and policy generation; drive team-wide adoption
• Deliver Tech Governance-level reporting including governance dashboards and executive briefs on remediation status, risk exposure, and regulatory posture, independently and to publication standard
• Track the regulatory horizon by monitoring evolving requirements across active jurisdictions, translating changes into prioritized internal action, and briefing senior leadership proactively

What you bring

• Active daily use of AI tools to accelerate compliance and governance work, with demonstrated practice showing measurable output impact, not theoretical awareness
• Ability to identify, build, and scale AI-assisted workflows within a Tech Governance office context, with evidence of automation, policy generation, audit response, or control monitoring
• Working knowledge of AI governance and risk, sufficient to contribute to internal AI oversight frameworks and assess AI-related compliance obligations
• Demonstrated ability to own and drive complex, multi-stakeholder work streams independently, setting direction, coordinating accountability, and delivering outcomes without management escalation
• Track record of influencing without authority across engineering, legal, finance, and operations in a fast-moving environment
• Comfort operating under ambiguity and shifting priorities while maintaining institutional-grade standards for accuracy and documentation
• 8+ years in IT audit, risk management, compliance, or security governance
• 3+ years leading governance programs at a large-scale internet, financial services, or crypto firm
• Deep working knowledge of ISO 27001, SOC 1/2, PCI-DSS, COBIT, and NIST
• Knowledge of GDPR and APAC data protection regimes
• Ability to read and interpret code, architecture diagrams, and technical design documents without engineer-translation dependency
• Familiarity with cloud environments such as Alibaba Cloud, AWS, and GCP, and associated security tooling
• Executive-level written and verbal communication in English, producing board-ready governance briefs, regulator responses, and Tech Governance-level reporting independently
• Proficiency in Mandarin (written and verbal) as a strong advantage for APAC regulatory and stakeholder engagement

Nice to have

• Professional security or governance certification: CISA, CISSP, CRISC, CISM, CCISO, or Agentic AI
• Experience building AI-powered compliance tooling such as audit automation, continuous control monitoring, or policy-to-control mapping
• Prior involvement in SOX ITGC, SEC Reg S-K Item 106, or equivalent listing-authority tech governance programs
• Crypto-native compliance exposure including Proof of Reserves, SAB 121, Travel Rule, and AML/CFT program governance
• Active regulatory footprint across MAS, VARA, FCA, HKMA/SFC, or equivalent
• Exposure to IPO-readiness or high-scrutiny regulatory examination programs
• Crypto and blockchain-specific compliance risk awareness

What we offer

• Base salary of $223,611 to $268,333, depending on job-related knowledge, skills, experience, and market location
• Performance bonus and long-term incentives as part of the compensation package
• Comprehensive healthcare schemes for employees and dependents
• Learning and development programs and education subsidy for growth and development
• Wellness and meal allowances
• Various team building programs and company events

About OKX

OKX is a leading crypto exchange and developer of OKX Wallet, giving millions access to crypto trading and decentralized crypto applications. OKX is also trusted by hundreds of large institutions seeking access to crypto markets and is backed by its Proof of Reserves. Operating across 50+ jurisdictions with live regulatory programs, OKX is building infrastructure-grade compliance capability rather than checkbox compliance.