Technology and Security Risk Director

As a Technology and Security Risk Director at OKX, you'll lead the Second Line of Defence (2LOD) Security & Data Risk programs, overseeing technology and security risk management across a leading crypto exchange and developer of OKX Wallet. You'll work with Engineering, Product, Risk, Compliance and Internal Audit to scale OKX's technology resilience and cybersecurity oversight, combining technical depth with independent risk challenge.

What you'll do

• Collaborate with internal stakeholders across the company to proactively identify, escalate, assess, and mitigate Technology and Security risks, ensuring adherence to the Technology Risk Policy
• Provide oversight of Technology and Security Risk incidents and issues, partnering with first-line stakeholders to enhance related processes and ensure effective oversight
• Lead the Technology Risk and Control Self-Assessment (RCSA) process from a 2LOD perspective, ensuring adherence to ERM RCSA methodology and providing effective challenge and oversight of first-line Security risks and controls
• Support the Security Key Risk Indicators (KRIs) definition, monitoring, and reporting
• Support the implementation and ongoing enhancement of Governance, Risk, and Compliance (GRC) systems to enable effective risk oversight
• Advocate and support the implementation of Risk Management frameworks for technology stakeholders, serving as a trusted advisor for the first line
• Stay up to date on emerging trends and regulations in the digital asset space, proactively identifying and addressing new risk considerations

What you bring

• 8+ years in information security, with a strong security architecture or technical security background; fintech, crypto or cloud-native experience preferred
• Practical experience designing, implementing or reviewing cloud, IAM, cryptographic, network or application security controls
• Experience in risk oversight, or readiness to transition, with the technical judgement to challenge controls and recommend proportionate improvements
• Ability to threat-model systems and assess technical evidence, including architecture diagrams, IAM policies, logging configurations and dependencies
• Working knowledge of cloud resilience, multi-region/AZ failover, RTO/RPO and disaster recovery testing
• Familiarity with NIST CSF, ISO 27001, SOC 2 and relevant privacy requirements, including GDPR and PDPA, and their application to technical controls
• Ability to independently assess and test controls, evaluate incidents and drive remediation with engineering and security teams
• Clear written and verbal communication, translating technical findings into prioritised actions for business stakeholders and governance committees
• Strong stakeholder management skills, providing constructive challenge and collaborating across functions and geographies
• A proactive, adaptable approach, with confidence taking ownership and improving practices

Nice to have

• GRC platform experience
• A relevant degree or equivalent practical experience; CISSP, CCSP, cloud security/architecture, CISA or CISM qualifications

What we offer

• Competitive total compensation package
• L&D programs and education subsidy for your growth and development
• Various team building programs and company events
• Wellness and meal allowances
• Comprehensive healthcare schemes for employees and dependants

About OKX

OKX is a leading crypto exchange and developer of OKX Wallet, providing millions access to crypto trading and decentralized applications, and a trusted platform for hundreds of large institutions. OKX is part of OKG, a blockchain group bringing crypto products including OKX, OKX Wallet, and OKLink to users worldwide.