Information Security Specialist, Information Technology

Position Summary

The Information Security Specialist reports directly to the Deputy Head of Information Technology and is responsible for supporting the school's cybersecurity and information security programme. The primary focus of the role is to review, monitor, and maintain the effectiveness of the school's information security controls, systems, and solutions to ensure ongoing compliance with audit, regulatory, and governance requirements.

Working closely with internal stakeholders, external auditors, vendors, and security partners, the role coordinates security assessments, audits, compliance reviews, and remediation activities. The position is responsible for maintaining security documentation, supporting risk management processes, and ensuring that security controls remain effective and aligned with industry best practices.

The Information Security Specialist also plays a key role in promoting cybersecurity awareness across the organisation, leading initiatives such as anti-phishing campaigns, security awareness training, and other activities that strengthen the school's overall security culture.

The role is responsible for administering and monitoring cybersecurity platforms and infrastructure, including firewalls, endpoint protection solutions, and other security technologies. Working alongside the organisation's Security Operations Centre (SOC) and technology teams, the position supports threat monitoring, incident response, vulnerability management, and the continuous improvement of the school's security posture.

The ideal candidate will possess strong knowledge of cybersecurity frameworks, security technologies, audit and compliance processes, and information security best practices, along with the ability to effectively communicate and collaborate with both technical and non-technical stakeholders.

Candidates with more experience may be considered for a Senior Information Security Specialist or Information Security Architect role.

Duties & Responsibilities

• Review, assess, and maintain the effectiveness of the school's information security controls, platforms, and processes to ensure compliance with internal policies, audit requirements, regulatory obligations, and industry best practices.
• Coordinate and support internal and external security audits, assessments, compliance reviews, and risk management activities, acting as the primary liaison between auditors, vendors, consultants, and internal stakeholders.
• Administer, monitor, and continuously improve cybersecurity technologies and infrastructure, including firewalls, endpoint protection platforms, email security, identity and access management solutions, and other security systems.
• Work closely with the Security Operations Centre (SOC) and technology teams to support threat monitoring, incident response, vulnerability management, security investigations, and remediation efforts.
• Promote and champion information security awareness across the organisation through training, communications, phishing simulations, anti-phishing campaigns, and other cybersecurity awareness initiatives.
• Provide security guidance and operational support for Microsoft 365, Microsoft Entra ID (Azure AD), Intune, and related cloud services, while leveraging familiarity with Apple device ecosystems (macOS and iPadOS). Experience administering and maintaining Microsoft 365 and Azure environments is considered a strong advantage.

Professional Experience & Qualifications

• Bachelor's degree or equivalent in Information Security, Cybersecurity, Information Technology, Computer Science, or a related discipline, with relevant industry certifications such as CISSP, CISM, Security+, SC-200, SC-300, AZ-500, or equivalent certifications highly desirable.
• Minimum 5 years of hands-on experience in information security, cybersecurity operations/engineer, IT compliance and audit, or related IT Infosec-focused roles
• Strong knowledge of cybersecurity frameworks, security governance, audit and compliance requirements, risk assessments, vulnerability management, incident response, and information security best practices, with demonstrated experience supporting audits and remediation activities.
• Proven experience administering and supporting security technologies including firewalls (Fortinet, Sangfor, Juniper, H3C etc.), endpoint protection platforms (JAMF, Sentinel One, MS Defender), email security solutions, IAM solutions, vulnerability management tools, security training, and security monitoring platforms.
• Strong understanding of Microsoft 365, Microsoft Entra ID (Azure AD), Microsoft Defender and related cloud security technologies, with experience administering Microsoft 365 and Azure environments considered a significant advantage; familiarity with Apple device ecosystems including macOS, iPadOS, and enterprise device management solutions is also desirable.
• Excellent analytical, communication, and stakeholder management skills, with the ability to work effectively with internal users, leadership teams, external auditors, vendors, security partners, and SOC, while maintaining a proactive, detail-oriented, and security-focused approach.

What We Offer

• 13th-month pay
• 5 days of school holidays (in addition to annual leave)
• Complimentary school bus service (with shuttle routes conveniently passing through major MTR stations across Hong Kong Island and Kowloon)
• Staff discounts at the school canteen

Application Procedures

Please include a covering letter, a detailed résumé, current and expected salaries, the names and contact information of three references and send to us by email.

Candidates should note, however, that in the event outstanding applicants are identified early for any of the above position, CDNIS reserves the right to make an appointment before the closing date (if applicable).   For this reason, it is important that interested candidates apply as soon as possible.

Successful candidates will be short-listed and will be contacted for interviews.

Safety is Our First Priority

CDNIS believes that every child has the right to grow up in a healthy, safe, secure and supportive environment.  As an institution CDNIS prioritises and promotes child protection above all else and adopts a strict zero tolerance policy towards the mistreatment or abuse of children.

CDNIS supports the International Task Force on Child Protection (ITFCP) Reports and Recommendations and we hold ourselves to a high standard of effective recruitment practices with specific attention to Child Protection.

As part of our safer recruitment procedures, CDNIS conducts pre-employment  reference checks before confirming any appointment.  Furthermore, CDNIS requests all successful candidates to undergo criminal record checks at their local police and/or Sexual Conviction Record Check (SCRC) in Hong Kong.

Personal data collected are for recruitment purpose only and will be used strictly in accordance with the employer's personal data policies. Please refer to the Canadian International School of Hong Kong Limited's Privacy Policy Statement at CDNIS Privacy Policy (https://www.cdnis.edu.hk/policies/privacy-policy).

Personal data of unsuccessful applicants will be retained for a maximum of 24 months from the date the vacancy has been filled.