Business and Risk Analyst - ERM, TRM framework, COBIT, ISO27001, NIST

InfoTech Services (Hong Kong) Limited; Sha Tin; On-site; HKD 446,400 - 669,600; Full time

Job summary

InfoTech Services (Hong Kong) Limited is seeking a Business and Risk Analyst to support technology risk and governance activities. The ideal candidate will possess over 5 years of experience in operational risk and IT governance within large enterprise environments, particularly in regulated industries. Responsibilities include conducting risk assessments and preparing governance reports. This is a one-year renewable contract based in Sha Tin, Hong Kong.

Qualifications

• More than 5 years of experience in technology risk, operational risk, or IT governance
• Experience in banking or regulated industries preferred
• Understanding of ERM and IT risk frameworks like COBIT, ISO27001, NIST

Responsibilities

• Support technology risk and governance activities
• Perform risk assessments in alignment with ERM Policy
• Prepare structured risk summaries and governance reporting

Skills

Technology risk

Operational risk

IT governance

Analytical skills

Stakeholder communication

Job description

Job Title/ Category Business and Risk Analyst - ERM, TRM framework, COBIT, ISO27001, NIST

Number Of Vacancy: 1

Relevant Field: Technical Support

Nature: Contract

Contract Period: One year renewable contract

Payroll: InfoTech

Employer: Business charitable organization

Location: Base Sha Tin

Work Outside Current Location: N/A

Monthly Salary Range: HK$ N/A - N/A

Project Nature

The Business and Risk Analyst supports technology risk and governance activities by applying established enterprise risk and control frameworks to technology systems and services.

Duties

• Serve a contract assignment with a charitable organization;
• Collect, compile, validate, and reconcile information to support technology inventories and assessments;
• Perform risk assessments in alignment with Enterprise Risk Management (ERM) Policy and Technology Risk Management Framework (TRMF);
• Identify and document key technology, security, and operational risk considerations;
• Review security measures and control arrangements at a high level;
• Prepare structured risk summaries and support governance and management reporting.

Experience

Yrs of Total Post-Quali Exp: 5.0

Yrs of Relevant Exp: 5.0

Requirements

• More than 5 years of experience in technology risk, operational risk, or IT governance within large enterprise environments; experience in banking or other highly regulated industries is preferred;
• Understanding of ERM and common IT risk frameworks, e.g. COBIT, ISO27001, NIST;
• Experience in supporting governance, assurance or risk assessment activities;
• Strong analytical, documentation and stakeholder communication skills.

Last Update: 27 Apr 2026