Security Risk Coordinator: Vendor & Third-Party Risk

Michael Page (Hong Kong); Hong Kong; On-site; HKD 420,000 - 620,000; Full time

Job summary

Michael Page (Hong Kong) is seeking a Security Risk Coordinator to join its risk governance practice. You will conduct vendor security assessments, review controls, and coordinate with business units, IT teams and suppliers to ensure risk is identified and remediated.

The role requires strong analytical skills, stakeholder management, and fluent English and Cantonese. Professional certifications such as CISA or CISSP are desirable but not required.

Qualifications

• Degree or Diploma in Information Security, Cybersecurity, Computer Science, Information Systems, Technology Risk, or related discipline.
• 2-4 years of experience in Information Security, Technology Risk, IT Audit, Security Governance, Risk & Compliance, or Third-Party Risk Management.
• Experience reviewing security controls, questionnaires, and supporting evidence is preferred.
• Good understanding of information security principles, technology risks, and security control frameworks.
• Exposure to third-party/vendor risk, cloud security, AI security, application security, outsourcing, or operational resilience is advantageous.
• Strong analytical and problem-solving skills with attention to detail.
• Effective stakeholder management and communication skills across business, technical, and vendor teams.
• Excellent written and verbal communication in English and Cantonese.
• Well-organized with ability to manage multiple assessments and priorities.
• Certifications such as CISA, CISM, CRISC, CISSP, or ISO 27001 are desirable but not required.

Responsibilities

• Conduct vendor security assessments and assurance reviews to evaluate security risks and control effectiveness.
• Review security questionnaires, policies, certifications, audit reports, and supporting evidence for adequacy.
• Identify gaps, weaknesses, exceptions, and residual risks; support remediation planning and tracking.
• Coordinate with business, IT, and vendors to gather information and resolve assessment queries.
• Track and follow up on findings, risks, and remediation actions through closure.
• Maintain assessment records, risk registers, action plans and audit documentation.
• Support ongoing monitoring and periodic reviews of third-party vendors based on risk and criticality.
• Prepare risk summaries, assessment reports, and stakeholder communications.
• Contribute to improving assessment methodologies, processes, templates, and governance frameworks.

Skills

Vendor risk management

Security assessments

Risk reviews

Stakeholder management

English & Cantonese communication

Education

Degree or Diploma in Information Security / related

Job description

Michael Page (Hong Kong) is seeking a Security Risk Coordinator to join its risk governance practice. You will conduct vendor security assessments, review controls, and coordinate with business units, IT teams and suppliers to ensure risk is identified and remediated.

The role requires strong analytical skills, stakeholder management, and fluent English and Cantonese. Professional certifications such as CISA or CISSP are desirable but not required.