GRC & Information Security Compliance Analyst

IO Tech Solutions Limited; Hong Kong; On-site; HKD 420,000 - 640,000; Full time

Job summary

IO Tech Solutions Limited in Hong Kong is seeking a GRC Analyst to join our information security team. The role focuses on governance, risk and compliance, working with technology and business stakeholders to identify and manage security risks and ensure regulatory compliance.

You will support GRC activities, conduct risk and control assessments, assist with ISO 27001 controls, and prepare risk and compliance reports for management.

Qualifications

• The role requires a degree in Information Security, Cybersecurity, IT, or related field.
• Minimum 2 years of GRC/InfoSec/IT Risk or compliance experience; senior roles may require 8–10+ years.
• Practical experience with ISO 27001 is highly preferred.
• Experience conducting risk assessments, control assessments, gap analyses, or security compliance reviews.
• Knowledge of frameworks such as NIST CSF, ISO 27001, COBIT or CIS Controls is advantageous.

Responsibilities

• Support Information Security GRC activities across the organisation.
• Conduct IT and Information Security risk assessments, control assessments and gap analyses.
• Assist in implementing and maintaining ISO 27001 security controls and requirements.
• Review security policies, standards, procedures and control frameworks.
• Monitor risks, exceptions and remediation actions with timely follow-up.
• Support internal and external audits including evidence collection and remediation tracking.
• Assess regulatory and compliance requirements and support their implementation.
• Prepare risk, compliance and security reports for management and stakeholders.
• Collaborate with IT, cybersecurity and business teams to close control gaps.

Skills

GRC expertise

Stakeholder management

Analytical skills

Documentation

English Cantonese communication

Education

Information Security degree

Tools

ISO 27001

NIST CSF

COBIT/CIS Controls

Job description

IO Tech Solutions Limited in Hong Kong is seeking a GRC Analyst to join our information security team. The role focuses on governance, risk and compliance, working with technology and business stakeholders to identify and manage security risks and ensure regulatory compliance.

You will support GRC activities, conduct risk and control assessments, assist with ISO 27001 controls, and prepare risk and compliance reports for management.