InfoSec & Compliance Analyst — ISO 27001 & Risk

Mavence Group Limited; Hong Kong; On-site; HKD 350,000 - 550,000; Full time

Job summary

One of APAC's fastest-growing B2B AI product companies seeks an Information Security & Compliance Analyst in Hong Kong. You will own audits, manage risk, and build data governance while collaborating with engineering and business teams to mitigate threats.

The role requires 3+ years in InfoSec/compliance, ISO 27001 exposure, and strong English/Chinese communication. Start-up environment experience and CISSP/CCEP are advantageous.

Qualifications

• 3+ years in InfoSec, compliance or risk.
• Experience responding to internal incidents and managing vendors.
• Exposure to ISO 27001 or similar certifications.
• Knowledge of data governance frameworks and best practices.
• Understanding of software development and IT infrastructure.
• Proactive and independent in a lean startup environment.
• Strong stakeholder management with fluency in English and Chinese.
• Certifications such as CISSP or CCEP are a plus.

Responsibilities

• Own internal and external IT/compliance audits while maintaining certifications like ISO 27001.
• Lead risk assessments, oversee SAST/DAST testing, and manage vulnerability scans.
• Build data governance policies and privacy standards (e.g., GDPR).
• Monitor security alerts across cloud infrastructure and manage incident response lifecycle.
• Proactively look out for hidden threats using updated intelligence data.
• Work closely with engineering and business teams to monitor and mitigate issues.

Skills

InfoSec

Compliance

Risk management

Incident response

Vendor management

Stakeholder management

Bilingual English/Chinese

Startup environment

Tools

ISO 27001

SAST/DAST

Vulnerability scanning

Job description

One of APAC's fastest-growing B2B AI product companies seeks an Information Security & Compliance Analyst in Hong Kong. You will own audits, manage risk, and build data governance while collaborating with engineering and business teams to mitigate threats.

The role requires 3+ years in InfoSec/compliance, ISO 27001 exposure, and strong English/Chinese communication. Start-up environment experience and CISSP/CCEP are advantageous.