Information Security Manager

The Information Security Manager owns and leads the school's information security function. This is a leadership role, not a technical operations role. In collaboration with the Director of Technology, the person in this position develops security strategy, owns the governance framework, manages external security partners, and drives the security program with consistent ownership, surfacing risks proactively and bringing recommendations forward to inform leadership decisions. The role sits at peer level with the Infrastructure Services Manager, Client Services Manager, and Data Services Manager within the IT Department.

KEY AREAS OF RESPONSIBILITY:

Security Leadership & Strategic Direction

• Own and lead the information security function at HKIS: setting direction, establishing priorities, and driving the program with consistent momentum.
• Collaborate with the Director of Technology and the other Technology Team Managers to develop and maintain a multi-year security strategy aligned to the school's risk profile, regulatory environment, and strategic direction.
• Proactively identify and communicate emerging threats, risks, and opportunities to the Director of Technology, including not only current exposure but where the threat landscape is heading. This role surfaces issues to leadership; it does not wait for them to be surfaced.
• Maintain a living security risk register and update on a regular cadence, in terms that enable informed decisions rather than technical reports.
• Lead the annual security planning process, with clear linkage between data, recommendations, and risk reduction outcomes.

Governance, Policy & Compliance

• Own the school's information security policy suite: develop, maintain, communicate, and enforce policies across the school.
• Lead PDPO alignment for security-relevant data handling, contributing to the school's data protection roadmap and ensuring schoolwide data handling operates in accordance with Hong Kong's regulatory framework.
• Own the accuracy and completeness of the school's cybersecurity insurance posture, ensuring that what is reported to insurers reflects operational reality, and that identified gaps have active remediation plans.
• Develop and maintain a security governance framework that clarifies decision rights, escalation paths, and change management processes for security-impacting decisions.
• Ensure security considerations are embedded in third-party vendor due diligence and contract processes, working collaboratively with Data Services and procurement stakeholders.

Security Operations & Partner Management

• Serve as HKIS's primary relationship manager for the managed SOC partner: owning the escalation path, acting on containment guidance within SLA, and ensuring access and configuration requirements on the HKIS side are maintained.
• Drive the ongoing evolution of the managed SOC engagement: evaluating scope, identifying gaps in detection or response coverage, and making recommendations on whether and how to expand toward active response capabilities.
• Manage the external vulnerability assessment and penetration testing partner relationship: ensuring findings are documented, prioritized by risk, remediated on defined timelines, and reported to leadership with appropriate context.
• Evaluate the external security partner ecosystem on an ongoing basis and make recommendations for scope changes or new partnerships as requirements evolve.

Identity, Access & Foundational Controls

• Own the school's identity and access management program: MFA deployment and enforcement, password policy, privileged access management, and account lifecycle governance.
• Maintain and continuously improve endpoint security posture across staff and student devices, in partnership with Infrastructure Services and Client Services.
• Ensure foundational controls are in place, verified, and documented, and that gaps are identified and remediated on a defined schedule rather than discovered reactively.

Incident Detection & Response

• Serve as Incident Response Lead for security incidents: owning the response, coordinating across teams, and communicating to leadership with appropriate speed and clarity.
• Own and maintain incident response playbooks, documentation, and disaster recovery procedures for security events, ensuring the school can respond effectively without improvising under pressure.
• Conduct structured post-incident reviews and translate learnings into program improvements.
• Ensure PDPO incident notification obligations are understood, documented, and executable, including the 72-hour notification requirement for applicable data breaches.

Vulnerability Management

• Own the school's vulnerability management program: internal scanning cadence, external assessment coordination, and remediation tracking.
• Ensure vulnerability findings are prioritized by risk, assigned to owners, remediated on documented timelines, and reported to leadership with clear status.
• Maintain a defensible remediation record: ensuring that the school can demonstrate at any point what is known, what is being addressed, and on what timeline.

AI: Threat Awareness & Defensive Application

• Maintain current and forward-looking awareness of how AI is reshaping the attack landscape, including AI-enabled phishing, deepfake-based social engineering, and automated vulnerability discovery. Ensure the school's defenses are calibrated to where attacks are heading.
• Leverage AI tools and automation to strengthen detection, accelerate investigation, and improve the efficiency and coverage of the security function.
• Contribute to the school's AI governance work from a security and PDPO perspective: advising on data exposure risks, shadow AI, and the security implications of AI tool adoption across the institution.

Cross-Functional Security Partnership

• Collaborate with Infrastructure Services, Client Services, and Data Services as a peer, ensuring security is embedded in infrastructure decisions, system integrations, and data platform design from the outset.
• Advise on the security dimensions of data systems and integrations, working alongside the Data Services team on processor assessment, API security, and data governance intersections.
• Partner with HR and academic and operational leadership on the cultural dimensions of security, ensuring the school's security posture is reinforced by people and practices, not only by technology.

Security Awareness & Culture

• Design and lead a schoolwide security awareness program: building the habits, knowledge, and shared responsibility that reduce human-factor risk across staff at all levels.
• Communicate security topics accessibly to non-technical audiences, including senior leadership, in ways that enable informed decisions.
• Build a security-aware culture across the institution: one where staff understand their role in the school's security posture and feel supported in playing it.
• Undertake other duties and functions as required that will impact and strengthen the contributions of the department and overall operations of the school.

Minimum requirements and qualifications:

Education:

• University graduate with a degree in Information Security, Computer Science, or related discipline.
• One or more of: CISSP, CISM, or CISA. SANS/GIAC certifications are highly valued.

Experience:

• Seven or more years of experience in information security or cybersecurity, with at least three years in a leadership, program management, or advisory capacity.
• Demonstrable experience developing and owning security programs, not only operating technical controls.
• Experience managing external security partners: managed SOC, MSSP, penetration testing providers, or equivalent.

Required skills:

• Familiarity with the Microsoft 365 security ecosystem, including Defender, Microsoft Sentinel, and Entra ID.
• Working knowledge of the MITRE ATT&CK framework and its application to detection and response.
• Working knowledge of PDPO or an equivalent data protection regulatory framework.
• Strong written and verbal communication skills; able to present risk and security posture clearly to non-technical senior stakeholders.
• Familiarity with emerging AI-enabled attack techniques and AI-assisted defensive tooling.
• Cantonese or Mandarin language skills are advantageous in the Hong Kong context.

Child Protection Statement:

• At HKIS, each child’s welfare is paramount. We act to ensure that our students enjoy the right to be protected from harm and exploitation and have their welfare safeguarded.

We invite you to learn more about our school and discover for yourself career opportunities in our remarkable HKIS community at www.hkis.edu.hk

Interested candidates please forward your updated resume together with a cover letter and references via clicking "Apply Now"

We look forward to hearing from you!

Personal data collected will be used for recruitment purposes only.