Technology and Security Risk Director

As a Technology and Security Risk Director at OKX, you lead the Second Line of Defence (2LOD) for technology and security risk oversight. You will be responsible for continuously refining and scaling the Technology and Security oversight program, guiding first-line execution, and providing independent risk challenge across OKX's global operations.

What you'll do

• Collaborate with internal stakeholders across the company to proactively identify, escalate, assess, and mitigate Technology and Security risks, ensuring adherence to the Technology Risk Policy
• Provide oversight of Technology and Security Risk incidents and issues, and partner with 1LOD stakeholders to enhance related processes and ensure effective oversight
• Lead the Technology Risk and Control Self-Assessment (RCSA) process from a 2LOD perspective, ensuring adherence to ERM RCSA methodology, and provide effective challenge and oversight of 1LOD Security risks and controls
• Support the Security Key Risk Indicators (KRIs) definition, monitoring, and reporting
• Support the implementation and ongoing enhancement of Governance, Risk, and Compliance (GRC) systems to enable effective risk oversight
• Advocate and support the implementation of Risk Management frameworks for technology stakeholders, serving as a trusted advisor for the first line
• Stay up to date on emerging trends and regulations in the digital asset space, proactively identifying and addressing new risk considerations

What you bring

• 8+ years in information security, with a strong security architecture or technical security background; fintech, crypto or cloud-native experience preferred
• Practical experience designing, implementing or reviewing cloud, IAM, cryptographic, network or application security controls
• Experience in risk oversight, or readiness to transition, with the technical judgement to challenge controls and recommend proportionate improvements
• Ability to threat-model systems and assess technical evidence, including architecture diagrams, IAM policies, logging configurations and dependencies
• Working knowledge of cloud resilience, multi-region/AZ failover, RTO/RPO and disaster recovery testing
• Familiarity with NIST CSF, ISO 27001, SOC 2 and relevant privacy requirements, including GDPR and PDPA, and their application to technical controls
• Ability to independently assess and test controls, evaluate incidents and drive remediation with engineering and security teams; GRC platform experience desirable
• Clear written and verbal communication, translating technical findings into prioritised actions for business stakeholders and governance committees
• Strong stakeholder management skills, providing constructive challenge and collaborating across functions and geographies
• A proactive, adaptable approach, with confidence taking ownership and improving practices in a dynamic environment
• A relevant degree or equivalent practical experience; CISSP, CCSP, cloud security/architecture, CISA or CISM qualifications desirable

What we offer

• Competitive total compensation package
• Learning and development programs and education subsidy for your growth and development
• Various team building programs and company events
• Wellness and meal allowances
• Comprehensive healthcare schemes for employees and dependants

About OKX

OKX is a leading crypto exchange and developer of OKX Wallet, serving millions of users in crypto trading and decentralized applications. OKX is trusted by hundreds of large institutions seeking access to crypto markets and is part of OKG, a blockchain group bringing crypto value to users worldwide through products including OKX, OKX Wallet, and OKLink.