IT Security and Risk Officer - Insurance, 25k

Michael Page (Hong Kong); Hong Kong; On-site; HKD 420,000 - 620,000; Full time

Job summary

Michael Page (Hong Kong) is seeking a Security Risk Coordinator to join its risk governance practice. You will conduct vendor security assessments, review controls, and coordinate with business units, IT teams and suppliers to ensure risk is identified and remediated.

The role requires strong analytical skills, stakeholder management, and fluent English and Cantonese. Professional certifications such as CISA or CISSP are desirable but not required.

Qualifications

• Degree or Diploma in Information Security, Cybersecurity, Computer Science, Information Systems, Technology Risk, or related discipline.
• 2-4 years of experience in Information Security, Technology Risk, IT Audit, Security Governance, Risk & Compliance, or Third-Party Risk Management.
• Experience reviewing security controls, questionnaires, and supporting evidence is preferred.
• Good understanding of information security principles, technology risks, and security control frameworks.
• Exposure to third-party/vendor risk, cloud security, AI security, application security, outsourcing, or operational resilience is advantageous.
• Strong analytical and problem-solving skills with attention to detail.
• Effective stakeholder management and communication skills across business, technical, and vendor teams.
• Excellent written and verbal communication in English and Cantonese.
• Well-organized with ability to manage multiple assessments and priorities.
• Certifications such as CISA, CISM, CRISC, CISSP, or ISO 27001 are desirable but not required.

Responsibilities

• Conduct vendor security assessments and assurance reviews to evaluate security risks and control effectiveness.
• Review security questionnaires, policies, certifications, audit reports, and supporting evidence for adequacy.
• Identify gaps, weaknesses, exceptions, and residual risks; support remediation planning and tracking.
• Coordinate with business, IT, and vendors to gather information and resolve assessment queries.
• Track and follow up on findings, risks, and remediation actions through closure.
• Maintain assessment records, risk registers, action plans and audit documentation.
• Support ongoing monitoring and periodic reviews of third-party vendors based on risk and criticality.
• Prepare risk summaries, assessment reports, and stakeholder communications.
• Contribute to improving assessment methodologies, processes, templates, and governance frameworks.

Skills

Vendor risk management

Security assessments

Risk reviews

Stakeholder management

English & Cantonese communication

Education

Degree or Diploma in Information Security / related

Job description

• Vendor security assessments, risk reviews, and security assurance activities
• Insurance

About Our Client

My client is one of the insurance companies in Hong Kong.

Job Description

As a Security Risk Coordinator, your main responsibilities will include:

• Conduct vendor security assessments and assurance reviews to evaluate security risks and control effectiveness.
• Review security questionnaires, policies, procedures, certifications, audit reports, and supporting evidence to assess control adequacy.
• Identify security gaps, control weaknesses, exceptions, and residual risks, and support remediation planning and tracking.
• Coordinate with business stakeholders, technical teams, and vendors to gather information and resolve assessment queries.
• Track and follow up on security findings, risks, and remediation actions through to closure.
• Maintain accurate assessment records, risk registers, action plans, and supporting documentation for audit and compliance purposes.
• Support ongoing monitoring and periodic reviews of third-party vendors based on risk profile and criticality.
• Prepare risk summaries, assessment reports, management updates, and stakeholder communications.
• Contribute to the continuous improvement of security assessment methodologies, processes, templates, and governance frameworks.

The Successful Applicant

A successful Security Risk Coordinator should have:

• Degree or Diploma in Information Security, Cybersecurity, Computer Science, Information Systems, Technology Risk, or a related discipline.
• 2-4 years of experience in Information Security, Technology Risk, IT Audit, Security Governance, Risk & Compliance, or Third-Party Risk Management.
• Experience reviewing security controls, questionnaires, and supporting evidence is preferred.
• Good understanding of information security principles, technology risks, and security control frameworks.
• Exposure to areas such as third-party/vendor risk, cloud security, AI security, application security, outsourcing, or operational resilience is advantageous.
• Strong analytical and problem-solving skills with excellent attention to detail.
• Effective stakeholder management and communication skills, with the ability to work across business, technical, and vendor teams.
• Excellent written and verbal communication skills in English and Cantonese.
• Well-organized with the ability to manage multiple assessments and priorities simultaneously.
• Professional certifications such as CISA, CISM, CRISC, CISSP, or ISO 27001 are desirable but not required.