- Reviewing, implementing, and maintaining information security and data privacy policies, procedures, and baselines in alignment with group standards and regional mandates.
- Ensuring comprehensive compliance with regional statutory requirements, including HKMA guidelines (TM-G-1, TM-G-2, SA-2, BYOD), HK PDPO, and CBIRC data protection regulations.
- Serving as the primary coordination bridge between local business units, IT, Compliance, and Head Office Group Information Security.
- Conducting Technology Risk Assessments, Risk and Control Self-Assessments (RCSA), and Third-Party Risk Assessments (TPRA).
- Tracking, monitoring, and driving remediation for open audit, security, and business continuity management (BCM) findings across Hong Kong, Mainland China, and the wider APAC region.
- Reviewing emerging regulatory circulars and notices, analysing operational impact, and designing actionable implementation roadmaps.
- Facilitating internal, external, and regulatory examinations in partnership with Head Office teams.
- Providing second-line oversight for business continuity management (BCM), incident response, digital forensics, and CSIRT breach handling.
- Governing regional security awareness initiatives and evaluating technical MIS dashboards covering patch management, vulnerability assessments, penetration testing, and endpoint security.
- Assessing and approving change requests, security exceptions, business requirements (BRDs), and technical architecture designs.
skills & experiences required.
- Minimum 3 years of dedicated experience in Information Security, IT Security, or Information Systems (IS) Audit within corporate banking, investment banking, or financial institutions.
- Bachelor’s or master’s degree in Computer Science, Information Technology, Engineering, or a related discipline.
- Solid working knowledge of HKMA cybersecurity modules, CBIRC guidelines, HK PDPO regulations, and international security standards (ISO 27001, NIST).
- Proven track record in developing InfoSec policies, drafting data privacy frameworks, and conducting risk assessments (RCSA / TPRA).
- Strong analytical capabilities to evaluate security risks, prioritise remediation activities, and communicate complex risks clearly to senior stakeholders.
- Mandatory fluency (spoken and written) in English, Cantonese, and Mandarin to liaise effectively with regional teams and regulators across Hong Kong and Mainland China.
- Recognised professional certifications such as CISA, CISSP, CISM, CCSP, GIAC (GWAPT), or ISMS Lead Auditor are highly advantageous.
If you are interested in this role, please click 'Apply Now' or send your CV directly to russell.regalado@randstad.com.hk
