Information Security Expert_C

Bosch Global Software (BGSW)•Suzhou, Jiangsu, China•On-site
Apply Direct →

About the Role

KEY RESPONSIBILITIES2.1 COMPLIANCE & RISK MANAGEMENT (~40%)Independently own the company’s information security governance program: develop the annual security and compliance roadmap, delivery plan, and resource requests - and be accountable for outcomesLead the build-out, operation, internal audit, and external certification of an ISO/IEC 27001 ISMS, driving non-conformity remediation to closureOwn China’s Cybersecurity Multi-Level Protection Scheme (MLPS 2.0): classification, registration, gap assessment, and remediationOperationalize obligations under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law (PIPL): data classification and grading, PIAs, and cross-border transfer complianceEstablish the risk assessment methodology; lead annual risk assessments, ad-hoc assessments, and third-party / supply chain security reviewsMaintain compliance registers and key risk indicators (KRIs) with a recurring reporting cadence to management and governance forumsInterface with regulators, customer security audits, and certification bodies; own the full find-remediate-verify-close cycle as the final backstop on remediation qualityProvide compliance advisory and security review to business, product, and engineering teams, embedding security requirements upstream into processesDrive policy rollout and compliance training; track departmental progress and tie results into performance evaluation2.2 ENABLEMENT & SECURITY CULTURE (~25%)Build a tiered security training program: compliance and awareness training for all staff, secure development training for engineers, and role-specific training for operations and business teams - integrated into onboarding and annual mandatory curriculaConduct security awareness campaigns (phishing simulations, security awareness week, case briefings) with measurable effectiveness evaluation and continuous improvementAuthor and maintain company-level policies, technical standards, and security baselines; own rollout, Q&A, and adoption checksEstablish durable culture mechanisms: departmental security liaisons / security champions, security performance indicators, positive incentives, and violation reportingDeliver presentations and training to varied audiences (executives, engineers, all staff), translating professional requirements into clear language and executable actionsTrack global regulatory developments and technology trends; produce decision-ready recommendations and internal knowledge assets2.3 SECURITY ARCHITECTURE & ENGINEERING (~15%)Contribute to security architecture planning and evolution; define technical requirements driven by compliance and risk control objectives and carry them through to deliveryLead or drive implementation of key controls: IAM / SSO, account and privilege governance, data encryption and masking, key management, endpoint and cloud security baselinesConduct security reviews of major initiatives (cloud migration, core system re-architecture, new business launches); produce risk findings and remediation requirements, and follow through to resolutionParticipate in security product selection and PoC validation; author company-level security baselines and technical specifications2.4 PENETRATION TESTING & RED TEAMING (~10%)Own authorized penetration testing of critical business systems and the external attack surface: develop the annual test plan, manage external vendors, and control delivery qualityReview test plans, execution, and reports; be able to reproduce and verify common vulnerabilities and judge whether remediation is genuinely effective; drive closure and re-testingConduct secure code reviews and software composition analysis (SCA); follow through on vulnerability remediationOrganize red team / purple team exercises and convert results into defensive improvements and training material2.5 DETECTION & INCIDENT RESPONSE (~10%)Drive detection capability: specify detection scenario requirements, follow through on rule implementation and false-positive suppression, and raise discovery rates for adversarial behaviorEstablish and maintain alert severity classification, incident handling SOPs, and emergency response plans; conduct regular drills and post-incident reviewsParticipate in triage, coordination, and root-cause review of major security incidents; deliver incident reports and drive remediationDrive full-lifecycle vulnerability management and remediation tracking; coordinate with the operations team and enforce remediation SLAs3.1 BASIC REQUIREMENTSBachelor’s degree or above; Information Security, Computer Science, Network Engineering, or Information Management preferred4+ years of information security experience, including 3+ years independently owning security governance, compliance, risk, or a security programAn IT background: substantive work or project experience in networking, systems operations, software development, or cloud; able to review technical designs and engage effectively with engineeringHas led the build-out of an ISO 27001 / MLPS / data compliance program and taken it through external audit or regulatory inspection to full closure3.2 TECHNICAL BACKGROUND & HANDS-ON CAPABILITYThis role is governance-led and does not carry a heavy offensive workload - however, it requires genuine technical grounding: understand it, verify it, hold the line. Engineering teams must not be able to explain away deficiencies.IT Fundamentals: Understand the TCP/IP stack and common network architectures; familiar with Linux and Windows security mechanisms and hardening essentials for common middleware and databasesTechnical Comprehension: Grasp Zero Trust, IAM/SSO, data encryption and masking, key management, and cloud-native / container security principles and control objectives; able to review whether a technical design satisfies compliance and security requirementsVulnerability & Attack Knowledge: Familiar with OWASP Top 10, MITRE ATT&CK, and common vulnerability mechanics; able to reproduce and verify common vulnerabilities and judge whether a fix effectively closes the issue (no unknown-vulnerability research expected)Tooling: Able to independently use common security tools for baseline checks - vulnerability scanning, configuration baseline review, asset and port discovery, account and privilege review - and to interpret scan reports and alertsData Handling: Working Python / Shell scripting for register maintenance, data reconciliation, and automated compliance checks3.3 GOVERNANCE & COMPLIANCE CAPABILITYDeep knowledge of ISO/IEC 27001, ISO/IEC 27701, MLPS 2.0, GDPR, and China’s cybersecurity and data protection legal framework; able to translate clauses into actionable controls and audit checkpointsProven ability to independently lead program build-out, conduct internal audits, manage external certification, and drive non-conformity remediationHands-on experience in risk assessment, data classification and grading, PIAs, and vendor security assessmentsSubstantive experience independently leading regulatory inspection responses and customer security audits3.4 ENABLEMENT & TRAINING CAPABILITYHas independently built an enterprise security training program or security awareness campaignAble to design curricula, deliver training, and conduct rollout sessions; adjusts depth and framing for different audiences (executives, engineers, all staff)Strong writing skills; able to independently produce policies, compliance reports, training materials, and executive-level briefings3.5 INDUSTRY CERTIFICATIONS (KEY SCREENING CRITERION)Candidates should hold at least one certification below. As this is a governance-led role, management-track and compliance/privacy certifications are preferred; technical certifications serve as supporting evidence.International - Governance: CISSP, CISM, CISA, CRISC, CCSPChina - Compliance: CISP (CISE / CISO), CISAW, MLPS evaluator certification, CCRC credentialsPrivacy: IAPP CIPP/E, CIPM, CIPT, ISO 27701 qualificationsTechnical Capability: CEH, Security+, OSCP, GPEN, GWAPTCloud Security: Alibaba Cloud / Tencent Cloud / Huawei Cloud security certifications; AWS Security Specialty, Azure Security Engineer, CCSK3.6 SOFT SKILLSOperates independently: develops plans, coordinates resources, and drives results without requiring step-by-step directionStrong cross-functional influence: builds consensus between business velocity, engineering efficiency, and compliance red lines – and drives remediation to closureCommunicates and trains effectively: explains risk to executives, requirements to engineers, and expected behavior to all staffBalances principle with pragmatism: uncompromising on red lines, flexible on implementationStrong documentation skills: independently produces policies, designs, reports, and training decks ready for reviewEnglish reading ability to work with original regulations and standards is a plus====================================================================== 4. NICE TO HAVEISO 27001 Lead Auditor (LA / LI) or certified internal auditor qualificationIndependent teaching, corporate trainer, or industry speaking experienceCompleted delivery of a data security governance or personal information protection compliance programTrack record leading a major regulatory inspection or large-scale security remediation programFirst-hand experience in IT operations, development, or cloud platform deliveryContribution to national, industry, or group-level standardsBy choice, we are committed to a diverse workforce and are an equal opportunity employer. Robert Bosch welcomes and encourages applications from people with disabilities. Accommodations are available on request for candidates taking part in the selection process.