Security Risk Coordinator / Analyst ($20K UP)

Manpower Services (Hong Kong) Limited; Hong Kong; On-site; HKD 203,000 - 243,000; Full time

Job summary

Manpower Services (Hong Kong) Limited seeks a hands-on Security Risk Coordinator/Analyst to support vendor security risk assessments and continuous assurance across third-party environments in a 12-month contract. You will review questionnaires, control reports and evidence to verify implementation, and coordinate remediation with stakeholders.

The role requires 2–4 years of information security experience, strong analytical skills, and fluency in English and Cantonese.

Qualifications

• 2–4 years hands-on information security experience.
• Experience reviewing security questionnaires and control reports (SOC 2, ISO 27001).
• Ability to coordinate with internal business units, technical teams and vendors.

Responsibilities

• Conduct end-to-end vendor security assessments and assurance reviews.
• Review security questionnaires, policies, SOC 2 / ISO 27001 reports, certifications and evidence.
• Identify gaps, track remediation plans with owners through to resolution.

Skills

Analytical skills

Stakeholder management

Evidence-driven mindset

English

Cantonese

Education

Degree or Diploma in Information Security / Cybersecurity

Tools

SOC 2 reports

ISO 27001 reports

Job description

Security Risk Coordinator / Analyst ($20K UP)

Our client, a well-known international company, is now looking for Security Risk Coordinator join within their team.

Job Description

We are seeking a hands-on and detailed-oriented Security Risk Coordinator / Analyst to join our Technology Risk & Information Security team on a 12-month contract basis.

In this role, you will play a key part in supporting vendor security risk assessments, reviewing security controls, and ensuring continuous assurance across third-party environments.

Key Responsibilities:

• Vendor Security Assessments: Conduct end-to-end vendor security evaluations and assurance reviews to identify security risks and control effectiveness.
• Evidence Review: Review security questionnaires, policies, SOC 2 / ISO 27001 reports, certifications, and technical supporting evidence to verify control implementation.
• Risk Tracking & Remediation: Identify security gaps, deficiencies, and residual risks; track remediation action plans with responsible stakeholders through to resolution.
• Stakeholder Coordination: Collaborate with internal business units, technical teams, and third-party vendors to clarify assessment responses and gather evidence.
• Audit Trail & Governance: Maintain comprehensive records of assessment findings, exceptions, and action plans to ensure proper audit readiness.
• Continuous Monitoring: Support periodic risk reviews of existing critical vendors and contribute to the enhancement of security assessment templates and methodologies.

Requirements & Qualifications

• Education: Degree or Diploma in Information Security, Cybersecurity, Computer Science, Technology Risk, or a related discipline.
• Experience: 2–4 years of hands-on experience in Information Security, Technology Risk, Third-Party Risk Management (TPRM), IT Audit, or GRC.
• Hands-on Capability: Practical experience reviewing security questionnaires, control reports (e.g., SOC 2, ISO 27001), and technical evidence is essential (pure administrative/coordination profiles will not be considered).
• Core Competencies: Good understanding of information security principles, technology risks, and common security control concepts. Exposure to Cloud Security, AI Risk, Application Security, or Operational Resilience is an advantage.
• Soft Skills: Strong analytical skills, evidence-driven mindset, and excellent stakeholder management abilities.
• Languages: Good written and spoken English and Cantonese.
• Certifications (Bonus): CISA, CRISC, CISM, CISSP, or ISO 27001 Lead Auditor is an advantage but not mandatory.