about the company.
Our client is a leading insurer in Hong Kong committed to maintaining robust governance, cybersecurity resilience, and regulatory compliance across Asia-Pacific. They invest heavily in modern Governance, Risk, and Compliance (GRC) platforms and continuous threat monitoring to safeguard enterprise operations, policyholder data, and partner ecosystems.
about the team.
You will join a dedicated Enterprise Risk Management function, working closely with Information Security, Legal, Procurement, and business unit owners. The team culture is analytical, collaborative, and detail-oriented, offering a structured environment to drive vendor risk governance and support regulatory audit readiness.
about the job.
- Execute initial risk triaging and inherent risk scoring for new vendor engagements based on data sensitivity, system connectivity, and business criticality.
- Administer due diligence questionnaires (such as SIG and CAIQ) and review independent assurance artefacts, including SOC 2 Type 2 reports, ISO/IEC 27001 certifications, penetration test summaries, and Business Continuity/Disaster Recovery (BCP/DR) plans.
- Identify control deficiencies, determine residual risk ratings, and collaborate with internal stakeholders and vendors to develop and track Corrective Action Plans (CAPs) through to closure.
- Conduct periodic reassessments aligned with vendor risk tiers, monitor external threat intelligence feeds (such as BitSight and SecurityScorecard) for vendor incidents, and enforce offboarding and data destruction requirements.
- Support Legal and Procurement teams by recommending appropriate risk and security clauses—including data protection, breach notification SLAs, and right-to-audit terms—during contract negotiations.
- Maintain accurate, audit-ready records within the GRC/TPRM platform, track Key Risk Indicators (KRIs), and assist with internal audits and regulatory examinations.
skills & experience required.
- Minimum 5 to 8+ years of experience in Third-Party Risk Management, Information Security, IT Audit, Operational Risk, or Regulatory Compliance.
- Bachelor’s degree in Information Systems, Cybersecurity, Risk Management, Finance, Business, or a related quantitative discipline.
- Working knowledge of industry security frameworks and standards, specifically NIST CSF, ISO/IEC 27001, and SOC 1 / SOC 2 reporting.
- Hands-on experience with GRC/TPRM platforms (such as OneTrust, ServiceNow VRM, Archer, ProcessUnity, or Prevalent) and continuous monitoring tools is preferred.
- Familiarity with relevant regulatory expectations (such as HKMA, GDPR, or DORA) and professional certifications (CTPRP, CRVPM, CISA, CRISC, or ISO 27001 Lead Auditor) is highly advantageous.
- Strong analytical and communication skills in English are required to translate technical security findings into clear business risk for non-technical stakeholders; proficiency in Cantonese or Mandarin is a plus.
If you are interested in this role, please click 'Apply Now' or send your CV directly to adyson.yau@randstad.com.hk.
...
