IT Security and Risk Officer - Insurance, 25k

Michael Page International (HK) Ltd; Hong Kong; On-site; HKD 254,000 - 304,000; Full time

Job summary

Michael Page International (HK) Ltd is seeking an IT Security and Risk Officer to coordinate security risk activities within the Insurance Technology department in Hong Kong. The role involves reviewing controls, policies, and audit reports to ensure risk adequacy and to support informed security decisions across the business.

The ideal candidate has 2–4 years in information security or technology risk, with strong analytical and stakeholder management skills, and fluency in English and

Qualifications

• Bachelor's/ Diploma in information security or related field.
• 2–4 years in information security, technology risk, IT audit, or risk management.
• Experience reviewing security controls, questionnaires, and evidence is preferred.

Responsibilities

• Coordinate security risk activities for the Technology department in the insurance sector.
• Conduct vendor security assessments and assurance reviews to evaluate risks.
• Review security questionnaires, policies, and audit reports for control adequacy.
• Identify gaps, weaknesses, exceptions, and remediation actions with tracking.
• Coordinate with stakeholders, technical teams, and vendors to resolve assessment queries.
• Maintain risk registers, action plans, and audit documentation for compliance.
• Support ongoing monitoring and periodic reviews of third-party vendors based on risk.
• Prepare risk summaries, assessment reports, and stakeholder updates.
• Contribute to improving security assessment methodologies and governance.

Skills

Information Security

Risk Management

IT Audit

Security Governance

English & Cantonese communication

Education

Degree or Diploma in Information Security or related

Certifications in information security (CISA, CISM, CRISC, CISSP, ISO 27001) desirable

Job description

IT Security and Risk Officer - Insurance, 25k

As a IT Security and Risk Officer, you will coordinate security risk activities for the Technology department within the Insurance industry. You will help maintain clear risk records and support informed security decisions across the business.

My client is one of the insurance companies in Hong Kong.

Description

As a Security Risk Coordinator, your main responsibilities will include:

• Conduct vendor security assessments and assurance reviews to evaluate security risks and control effectiveness.
• Review security questionnaires, policies, procedures, certifications, audit reports, and supporting evidence to assess control adequacy.
• Identify security gaps, control weaknesses, exceptions, and residual risks, and support remediation planning and tracking.
• Coordinate with business stakeholders, technical teams, and vendors to gather information and resolve assessment queries.
• Track and follow up on security findings, risks, and remediation actions through to closure.
• Maintain accurate assessment records, risk registers, action plans, and supporting documentation for audit and compliance purposes.
• Support ongoing monitoring and periodic reviews of third-party vendors based on risk profile and criticality.
• Prepare risk summaries, assessment reports, management updates, and stakeholder communications.
• Contribute to the continuous improvement of security assessment methodologies, processes, templates, and governance frameworks.

Profile

A successful Security Risk Coordinator should have:

• Degree or Diploma in Information Security, Cybersecurity, Computer Science, Information Systems, Technology Risk, or a related discipline.
• 2-4 years of experience in Information Security, Technology Risk, IT Audit, Security Governance, Risk & Compliance, or Third-Party Risk Management.
• Experience reviewing security controls, questionnaires, and supporting evidence is preferred.
• Good understanding of information security principles, technology risks, and security control frameworks.
• Exposure to areas such as third-party/vendor risk, cloud security, AI security, application security, outsourcing, or operational resilience is advantageous.
• Strong analytical and problem-solving skills with excellent attention to detail.
• Effective stakeholder management and communication skills, with the ability to work across business, technical, and vendor teams.
• Excellent written and verbal communication skills in English and Cantonese.
• Well-organized with the ability to manage multiple assessments and priorities simultaneously.
• Professional certifications such as CISA, CISM, CRISC, CISSP, or ISO 27001 are desirable but not required.