Information Technology Compliance Manager

financial Institution; Hong Kong; On-site; HKD 420,000 - 660,000; Full time

Job summary

A Hong Kong–based financial Institution seeks an experienced information security professional to lead and coordinate technology risk and cyber security efforts. The role reports to the Senior Manager or Department Head and involves updating policies, incident handling, and liaison with regulators.

Strong English and Chinese language skills are essential, with knowledge of ISO 27001 and HKMA guidelines preferred. This role offers growth in a regulated, high‑stakes environment.

Qualifications

• Bachelor's degree in information technology or related discipline.
• Minimum 5 years in information/cyber security or tech risk management.
• Solid understanding of fintech, data privacy and industry practices.
• Familiarity with ISO 27001, CSA STAR, HKMA SPM, and CISA/CISM/CCSP/CEH/CREST.
• Team player with good communication in English and Chinese.

Responsibilities

• Report to Senior Manager on technology compliance, cyber security, and information security.
• Establish, update, and maintain unit policies, procedures, and plans.
• Participate in cyber/information security drills by regulators.
• Assist Head in liaising with authorities and regulators.
• Coordinate incident reporting for IT, cybersecurity, and system incidents.
• Track latest cyber security regulatory requirements and identify enhancements.
• Collaborate with other departments on security controls and improvements.
• Conduct security risk assessments, technical assessments, audits, and reporting.
• Perform ad hoc duties or projects as assigned.

Skills

Information security

Cyber security

Technology risk

Regulatory know-how

Communication

Education

University degree in IT/cybersecurity

Tools

ISO 27001

HKMA SPM

CFI 2.0 framework

CISA

CISM

CISSP

Job description

Major Responsibilities

• Report to the Senior Manager or Department/Division Head on matters related to technology compliance, cyber security, and information security
• Establish, update, and maintain the unit’s policies, procedures, guidelines, and plans, particularly those related to regulatory, compliance, and law-enforcement matters
• Participate in cyber or information security drills initiated by industry bodies or regulators
• Assist the Head in liaising and communicating with designated authorities or regulators
• Assist in arranging and/or handling incident reporting matters related to IT, cybersecurity, and system incidents
• Keep abreast of the latest cyber security-related law-enforcement, regulatory, and/or industry requirements to facilitate the identification of potential enhancement areas
• Communicate and work with other departments/divisions on cyber and information security controls and enhancement matters
• Arrange and/or conduct computer-system security risk assessments, technical assessments, audits, and reporting according to the scope and requirements
• Perform any other ad hoc duties or projects as assigned

Requirements

• University degree, preferably in information technology, information/cyber security, computer science, or a related discipline
• Minimum 5 years of experience in information/cyber security or technology risk management. Candidates with less experience who meet the requirements may be considered for the deputy manager position
• Good understanding of technology risk management and cyber security best practices, with broad knowledge of fintech, data privacy, and/or industry practices
• Knowledge of ISO 27001, CSA STAR, the HKMA SPM, the CFI 2.0 framework, technology risk management, and cyber security-related guidelines
• CISA, CISM, CDPSE, CRISC, CISSP, CEH, CCSP, CREST, and/or other cyber resilience-related certifications preferred
• Team player with sound interpersonal and communication skills
• Red/Blue Team knowledge and experience are an advantage
• Good problem-solving and analytical skills
• Good command of written and spoken English and Chinese