Security Risk Manager - Remote, Flexible Hours, Fintech/Crypto

EMCD; Hong Kong; Remote; HKD 700,000 - 1,100,000; Full time

Benefits offered by this job

Remote-first

Flexible hours

Paid vacation 20 days + 12 days

Paid sick leave

English lessons

Professional growth

Company discounts

Mining access

Job summary

EMCD, a leading technology company in the crypto industry, is seeking a Security Risk Manager to own the cyber risk program, drive security audits, and lead regulatory licensing efforts. Remote-first with global reach.

You will assess risks for partners, maintain risk registers, report to C-level, coordinate SOC 2, and oversee the Governance & Compliance team to ensure compliance with VASP, MiCA, DORA, and related standards.

Qualifications

• Experience in information security risk management or GRC in fintech/crypto or regulated environments.
• Experience maintaining a risk register and coordinating with business risk owners.
• Practical knowledge of Third-Party Risk Management (TPRM).
• Familiarity with ISO 27001/27005, NIST CSF, SP 800-30 methodologies.
• Experience preparing for SOC 2 or ISO 27001 audits and evidence collection.

Responsibilities

• Conduct information security risk assessments of partners and vendors during onboarding and record risk treatment actions.
• Maintain the IS risk register and track implementation of risk treatment plans.
• Lead risk communication with C-level executives and orchestrate risk syncs.
• Coordinate SOC 2 initiatives, including CC3 risk assessments and Type 2 prep.
• Lead IS portion of regulatory licensing (VASP) applications and regulator inquiries.
• Lead the Governance & Compliance team (2 people): planning, workload allocation, and KPIs.

Skills

InfoSec Risk Mgmt

GRC

TPRM

SOC 2 prep

ISO 27001/27005

NIST CSF

Regulatory compliance

Crypto risk

Executive communication

Job description

EMCD, a leading technology company in the crypto industry, is seeking a Security Risk Manager to own the cyber risk program, drive security audits, and lead regulatory licensing efforts. Remote-first with global reach.

You will assess risks for partners, maintain risk registers, report to C-level, coordinate SOC 2, and oversee the Governance & Compliance team to ensure compliance with VASP, MiCA, DORA, and related standards.