IT Security Risk Manager, Security Solution and Compliance Management

Team Introduction
The IT Security team plays a pivotal role in safeguarding ByteDance's global office network and IT infrastructure. We work closely with cross-functional partners to manage security risks and ensure compliance with industry cybersecurity standards and government regulations. Our responsibilities include managing security risks, developing governing policies, implementing security control frameworks, and driving remediation efforts within the IT scope.

Responsibilities
As an IT Security Risk Manager, you will be responsible for:
- Developing, implementing and maintaining a comprehensive Cybersecurity Risk Management framework for IT, based on industry best practices (including ISO 31000, ISO 27005, and NIST 800-39).
- Establishing scalable processes and procedures for managing the security risk lifecycle, including risk identification, assessments, remediation, and continuous monitoring within the IT environment.
- Creating and maintaining a Risk Register based on business requirements, consistently tracking, re-assessing and updating risks while providing leadership with data-driven insights on security trends.
- Managing exception and acceptance processes to evaluate residual risks, balancing security gaps, compensating controls, and business risk tolerance.
- Collaborating with risk owners to ensure that risk mitigation plans are developed, tracked, and completed on time, while regularly reporting on remediation progress.
- Work closely with security engineers, IT teams and XFN stakeholders to implement technical security controls, enhance security configurations, and remediate high-risk vulnerabilities.
- Oversee vulnerability identification, assessment, and remediation efforts, ensuring that security patches and updates are applied effectively to minimize risk exposure.
- Ensure IT adherence to compliance standards by facilitating audits, developing governance policies, implementing security control frameworks, and conducting risk assessments.
- Preparing and presenting regular executive reports on security risks and compliance status, and remediation progress to leadership, providing strategic insights into the current landscape.