Responsibilities:

• Provide updates to the Senior Manager or Division Head on technology compliance, cybersecurity, and information security matters
• Develop, revise, and maintain departmental policies, procedures, guidelines, and plans, especially those tied to regulatory, compliance, and law‑enforcement requirements
• Take part in cybersecurity and information security exercises organized by regulators or industry associations
• Support the Head in coordinating and communicating with relevant authorities and regulators
• Assist with the preparation and management of incident reports related to IT, cybersecurity, and system events
• Stay informed on the latest regulatory, law‑enforcement, and industry developments in cybersecurity to identify areas for improvement
• Collaborate with other teams on strengthening cyber and information security controls
• Organize and/or perform system security risk reviews, technical evaluations, audits, and reporting in line with defined scope and standards
• Carry out other ad hoc assignments or projects as directed

Requirements:

• Bachelor’s degree in information technology, cybersecurity, computer science, or a related field
• At least 5 years of experience in cybersecurity or technology risk management (candidates with less experience may be considered for Deputy Manager)
• Solid grasp of technology risk management and cybersecurity practices, with broad exposure to fintech, data privacy, and industry standards
• Familiarity with frameworks and guidelines such as ISO 27001, CSA STAR, HKMA SPM, CFI 2.0, and other technology risk/cybersecurity standards
• Professional certifications such as CISA, CISM, CDPSE, CRISC, CISSP, CEH, CCSP, CREST, or similar are highly desirable
• Strong team orientation with effective communication and interpersonal skills
• Experience or knowledge in Red/Blue Team operations is advantageous
• Strong analytical and problem‑solving abilities
• Proficiency in both written and spoken English and Chinese