InfoSec Architecture & Change Lead

PFCC Group; Hong Kong; On-site; HKD 180,000 - 240,000; Full time

Job summary

PFCC Group in Hong Kong seeks a Senior Analyst, Information Security (Architecture & Change) to shape and implement security strategy across networks and infrastructure. You will evaluate risks, regulatory requirements, and threat landscape to propose secure, business-aligned solutions.

The role requires deep security domain knowledge, DevSecOps experience, and strong communication to partner with IT and business units. Fluent English and professional certifications are preferred.

Qualifications

• Minimum 5 years IT experience, with at least 3 years in Information Security.
• Strong knowledge of security tooling and architectures.
• Experience with ISO 27001, NIST CSF, CIS controls; familiarity with PCI-DSS, GDPR, MCSL regulatory requirements.

Responsibilities

• Assist with designing and developing the company’s security strategy to improve and maintain its security posture/maturity level.
• Understand current security risks and threat landscape and regulatory requirements.
• Identify new security solutions or enhancements to enable business objectives.
• Collaborate with business units and IT to balance information security and business needs.
• Assess network architecture designs for alignment with security architecture and best practices.
• Stay informed on latest security technologies and vendor evaluations.
• Plan, track and review vendor deliverables; ensure compliance with ISO27001 requirements.

Skills

Security architecture

DevSecOps

Threat intelligence

Education

Bachelor's degree in Computer Science

CISSP or CISM certification

Tools

PAM

SIEM

WAF

EDR

DLP

Email security

Job description

PFCC Group in Hong Kong seeks a Senior Analyst, Information Security (Architecture & Change) to shape and implement security strategy across networks and infrastructure. You will evaluate risks, regulatory requirements, and threat landscape to propose secure, business-aligned solutions.

The role requires deep security domain knowledge, DevSecOps experience, and strong communication to partner with IT and business units. Fluent English and professional certifications are preferred.