Information Security Manager - Cybersecurity / IT risk / IT governance

About the role

This role is responsible for handling information security management, responding to threats and incidents, and driving remediation actions to address identified risks. The position works closely with the Legal team to identify relevant information management and protection laws and regulations and to implement actions that support compliance. It also involves overseeing internal and external compliance requirements, including PCI and data privacy obligations, while maintaining the organization's information management and protection framework. The role supports security awareness, training, vendor assessments, privacy security assessments, and global projects as part of a regional ISO team. It also collaborates with security operations to respond to incidents involving personal or confidential information, system hacking, information leakage, information breaches, and physical security concerns.

Key responsibilities

• Handle information security management activities, including threats, incidents, and remediation actions across the organization.
• Work with the Legal team to identify applicable information protection laws and regulations and support compliance implementation.
• Track and oversee internal and external compliance requirements, including PCI, data privacy, policies, procedures, standards, baselines, and controls.
• Maintain an information management and protection framework that supports effective company-wide governance.
• Manage day-to-day security activities, including vendor security assessments, privacy security assessments, and policy implementation.
• Support information security requirements across different business units and assist global projects as a regional ISO team member.
• Work with security operations to respond to incidents involving confidential information, hacking, leakage, breaches, and physical security issues.

About you

• Degree holder in Management, Information Technology, Information Security, Computer Science, or a related discipline.
• At least 6 years of experience in information security, cybersecurity, IT risk, or governance-related functions.
• Strong knowledge of information security governance, risk assessment, compliance frameworks, and data privacy requirements.
• Familiarity with cybersecurity standards, regulations, and best practices, with the ability to translate requirements into practical business solutions.
• Experience managing security controls across Microsoft 365, network, and enterprise technology environments.
• Professional security certifications such as CISSP, CISM, CISA, or GIAC are highly preferred.
• Strong analytical thinking, business process improvement, and risk management capabilities.
• Excellent communication and stakeholder management skills, with the ability to influence and educate employees at all levels.
• Proactive, adaptable, and highly accountable, with the ability to manage multiple projects and priorities independently.
• Fluent in Cantonese, English, and Mandarin.