Deputy Head, Information Security

Don Nelson Recruitment Limited; Hong Kong; On-site; HKD 1,200,000 - 1,800,000; Full time

Job summary

Don Nelson Recruitment Limited is seeking an senior information security leader to drive governance, risk management, and cloud security across the organization. You will align security policy with regulatory requirements, oversee audits, and coordinate regulatory reviews while liaising with regulators and external stakeholders.

The ideal candidate brings 15+ years in IT/cybersecurity with CISSP/CISM/CISA or ISO 27001 Lead Implementer/Auditor certification, and strong cross-functional leadership

Qualifications

• Bachelor's degree in CS, Engineering or related field.
• 15+ years’ experience across IT, cybersecurity, and data security.
• CISSP, CISM, CISA, or ISO 27001 Lead Implementer/Auditor required.
• Strong leadership, project management, and cross-functional collaboration.

Responsibilities

• Lead cybersecurity and data security governance, strategy, and risk management across the organization.
• Develop and enhance security frameworks, policies, standards, and operating procedures.
• Establish governance covering data lifecycle management, protection, and loss prevention.
• Identify, assess, and mitigate cybersecurity and data security risks.
• Provide security risk, compliance, and governance reporting to management and committees.
• Define cloud security governance across AWS, Azure, and Alibaba Cloud environments.
• Ensure compliance with regulatory, legal, and industry security requirements.
• Coordinate audits, regulatory reviews, assessments, and due diligence activities.
• Act as the primary liaison with regulators, auditors, and external stakeholders on security matters.

Skills

Cybersecurity leadership

Regulatory compliance

Risk management

Cloud security

Incident response

Vendor risk management

Security governance

Stakeholder management

English/Chinese bilingual

Education

Bachelor's degree in CS/Engineering

Job description

Lead cybersecurity and data security governance, strategy, and risk management across the organization

Develop and enhance security frameworks, policies, standards, and operating procedures

Establish governance covering data lifecycle management, protection, and loss prevention

Identify, assess, and mitigate cybersecurity and data security risks

Provide security risk, compliance, and governance reporting to management and committees

Define cloud security governance across AWS, Azure, and Alibaba Cloud environments

Ensure compliance with regulatory, legal, and industry security requirements

Coordinate audits, regulatory reviews, assessments, and due diligence activities

Act as the primary liaison with regulators, auditors, and external stakeholders on security matters

Oversee SOC operations, threat monitoring, incident management, and security technology support

Govern vulnerability management in partnership with application, platform, and infrastructure teams

Provide security oversight across architecture, cloud adoption, applications, and infrastructure initiatives

Evaluate emerging threats and technologies to strengthen security posture and cyber resilience

Manage third‑party security risk assessments and vendor security controls

Lead security awareness and training programs to strengthen security culture

Partner with business, technology, risk, compliance, and legal teams to drive secure operations

Support the Head of Information Security in executing security strategy and roadmap

Mentor security professionals and promote a high‑performance security culture

Manage cybersecurity projects and ensure effective delivery of security initiatives

Lead incident response, recovery, disaster recovery, business continuity, and cyber resilience exercises

Requirements

• Bachelor’s degree or above in Computer Science, Engineering, or related discipline
• 15+ years’ experience across IT, cybersecurity, and data security
• Strong expertise in firewalls, WAF, application security, cloud security, web gateways, endpoint protection, SIEM, threat hunting, IAM, application whitelisting, O365, DLP, network security, and email security
• Experience in governance, risk management, compliance, and security operations leadership
• Strong project management, stakeholder engagement, and multitasking abilities
• Independent, detail‑oriented, and results‑driven mindset
• Proactive approach with strong leadership and people management skills
• Ability to lead cross‑functional initiatives involving multiple teams and technologies
• Strong written and verbal communication skills in English and Chinese, with Putonghua required
• Professional certifications such as CISSP, CISM, CISA, or ISO 27001 Lead Implementer/Auditor required

**This position is offered through a strategic partnership between Don Nelson Technology Limited and NP Solution Limited.