Manager, Information Protection Group (MJ008415)

KPMG China; Hong Kong; On-site; HKD 900,000 - 1,300,000; Full time

Job summary

KPMG China is seeking an experienced Manager for the Information Protection Group within Quality Risk Management to strengthen information security governance, risk management, and compliance programmes across the organisation. You will oversee certification initiatives, advise stakeholders on security requirements, and promote a strong security culture across regional and global teams.

The role focuses on managing ISO 27001 and ISO 27701 compliance, handling third-party risk, and ensuring

Qualifications

• Bachelor's degree in Information Security, Computer Science, Information Technology or a related discipline.
• 5–8 years of relevant experience in information security, IT risk management, compliance, audit or cybersecurity governance.
• Strong understanding of information security frameworks, risk management methodologies and technology control environments.
• Hands-on experience managing ISO 27001 and ISO 27701 compliance programmes and supporting internal and external audits.
• Experience conducting third-party risk assessments, reviewing vendor security controls and monitoring remediation activities.
• Experience supporting client security reviews and advising on contractual information security and compliance requirements.
• Desirable certifications include CISA, CISM, CISSP, CISP or equivalent.

Responsibilities

• Manage information security compliance programmes (ISO 27001, ISO 27701) across China and Hong Kong and coordinate audits.
• Assess service providers for security/compliance risks and monitor remediation actions.
• Coordinate client security questionnaires and due diligence, review security requirements in contracts.
• Coordinate security awareness campaigns and phishing simulations across units.
• Report information security incidents and track remediation and post-incident reviews.
• Monitor regulatory developments and industry best practices to identify gaps and improvements.
• Collaborate with cross-functional stakeholders to deliver high-quality work on time.

Skills

Information security governance

Risk management

Audit & compliance

Stakeholder management

Security awareness

Education

Bachelor’s degree in Information Security/Computer Science/IT

Tools

ISO 27001

ISO 27701

Job description

KPMG China provides multidisciplinary services from audit and tax to advisory, with a strong focus on serving our clients' needs and their industries. At KPMG, you'll translate insights into action and reveal opportunities for all—our teams, our clients and our world.

Service Line Overview

KPMG's Information Protection Group (IPG), an internal service team under Quality & Risk Management (QRM), focuses on driving matters covering information security, privacy, data rights and movement management. The team is to ensure expectations from our clients and regulatory bodies are addressed to stay competitive in our business.

We are seeking an experienced and proactive Manager to join the Information Protection Group within the Quality Risk Management department. This role will help strengthen information security governance, risk management and compliance programmes across the organisation. The successful candidate will manage certification and compliance initiatives, advise business stakeholders on security requirements, oversee third-party risk management and promote a strong security awareness culture. The role involves close collaboration with regional and global teams to ensure that information security practices support business objectives, meet client expectations and comply with regulatory obligations.

Key Responsibilities

• Manage and maintain information security compliance programmes (ISO 27001, ISO 27701) across China and Hong Kong, coordinate internal/external audits, and ensure findings and corrective actions are resolved within agreed timelines.
• Assess technology service providers for security and compliance risks, review security-related contract terms and due diligence responses, and monitor remediation actions through completion.
• Coordinate completion of client security questionnaires and due diligence requests, review client contracts for security requirements, and ensure consistent communication of the firm’s security controls.
• Coordinate phishing simulations and security awareness campaigns across all business units, develop security communications, and analyse awareness data to drive improvement plans.
• Coordinate assessment, escalation, and reporting of information security incidents, maintain accurate incident records, and track response and remediation actions to completion, including post-incident reviews.
• Monitor emerging cybersecurity threats, regulatory developments, and industry best practices; take a hands‑on approach to assessing technology controls, identifying gaps, and implementing improvements.
• Manage competing priorities and deliver assigned work to a high standard within deadlines, while communicating effectively and collaborating with stakeholders across different functions, business units, and locations.

Experience & Background

• Bachelor’s degree in Information Security, Computer Science, Information Technology or a related discipline.
• Five to eight years of relevant experience in information security, IT risk management, compliance, audit or cybersecurity governance.
• Strong understanding of information security frameworks, risk management methodologies and technology control environments.
• Hands‑on experience managing ISO 27001 and ISO 27701 compliance programmes and supporting internal and external audits.
• Experience conducting third‑party risk assessments, reviewing vendor security controls and monitoring remediation activities.
• Experience supporting client security reviews and advising on contractual information security and compliance requirements.
• Practical understanding of technologies such as generative AI, cloud computing, data analytics, network infrastructure and application security would be a strong advantage.
• Relevant professional certifications—such as CISA, CISM, CISSP, Certified Information Security Professional (CISP), or an equivalent qualification—are desirable.
• Strong stakeholder management, communication and report‑writing skills, with the ability to work effectively across different functions, business units and locations.
• Fluency in Cantonese, Mandarin and English.

About KPMG

At KPMG China, we are committed to being an equal opportunity employer, with zero tolerance for any form of discrimination against any persons. It is important for us to create an inclusive, diverse and agile workplace for our people to develop and thrive at both a personal and professional level.

We strive to make ESG (environmental, social and governance) a watermark running through our organisation; from empowering our people to become agents of positive change, to providing better solutions and services to our clients. To lead by example, we launched Our Impact Plan (OIP) which includes our ESG commitments and progress across four key pillars – Planet, People, Prosperity and Governance.

We encourage you to come as you are, and we welcome all qualified candidates to apply, and hope you unlock opportunities with us. Visit KPMG China website for more company information.

You acknowledge and agree that all personal information hereby provided regarding yourself will be used by KPMG China for its candidate selection purposed only. KPMG China collects, uses, processes, and retains your personal information in accordance with KPMG China's Online Privacy Statement and/or KPMG China Privacy Statement (collectively " Privacy Statement "). During the recruitment process, KPMG China may need to store personal information of candidates in a designated third‑party application tracking platform.

If you have any questions regarding the information you provided in the form or your job application in general, please contact KPMG China's HR personnel in the location where your application is submitted [see here].