Senior Information Security Risk & Governance Lead

The Hong Kong Jockey Club; Sha Tin; On-site; HKD 900,000 - 1,500,000; Full time

Job summary

The Hong Kong Jockey Club is seeking an experienced technology risk and cyber security professional to support governance forums and policy development in its SIIS Division. The role focuses on coordinating risk committees, producing high‑quality papers, and driving remediation across a large IT landscape.

Ideal candidates will have 10+ years in IT risk or cyber security, with hands‑on experience in mature assessments, policy frameworks and cross‑functional collaboration with IT, Audit and

Qualifications

• Ten years’ experience in technology risk or cyber security domains.
• Proven track record leading maturity assessments.
• Experience with large IT systems and risk frameworks.
• Exposure to legacy and modern platforms.

Responsibilities

• Coordinate end-to-end operation of Technology Risk committees and governance forums.
• Develop committee papers, management reports and presentations.
• Prepare meeting minutes and action logs; follow through to closure.
• Manage risk projects, timelines, and stakeholder engagement.
• Maintain and update Information Security Policy framework and standards.
• Coordinate policy compliance program and report on status.
• Monitor regulatory developments and align policies accordingly.
• Collaborate with IT, Cyber Security, Risk, Audit and business stakeholders.
• Define and monitor KRIs and technology risk posture; report to governance forums.
• Develop technology risk metrics and maturity scorecards for management.

Skills

Technology risk

Cyber security

Governance

Risk assessment

Education

Bachelor's or above in IT/IS

Job description

The Hong Kong Jockey Club is seeking an experienced technology risk and cyber security professional to support governance forums and policy development in its SIIS Division. The role focuses on coordinating risk committees, producing high‑quality papers, and driving remediation across a large IT landscape.

Ideal candidates will have 10+ years in IT risk or cyber security, with hands‑on experience in mature assessments, policy frameworks and cross‑functional collaboration with IT, Audit and