Senior Manager, Information Security Risk and Assurance (1-year Contract)

Sits within the Security, Integrity and Information Security (SIIS) Division, which is responsible for the Club's integrity by combatting criminality, corruption and information security risks, including cyber security that may impact business. The division maintains a secure environment and upholds integrity across Club operations through robust governance and proactive security measures. The position coordinates and supports the end-to-end operation of Technology Risk committees and governance forums, develops high-quality committee papers and management reports, and project manages key risk and governance activities.

• Coordinate and support the end-to-end operation of Technology Risk committees and governance forums, including forward agenda planning, coordinating papers and presenters, preparing meeting materials, managing timelines and ensuring governance deliverables are completed to a high standard.
• Develop and support high-quality committee papers, management reports and PowerPoint presentations, translating complex technology risk and information security matters into clear, concise and visually effective materials for senior management and governance forums.
• Prepare accurate and concise meeting minutes, capturing key discussions, decisions and actions, and maintain action logs to proactively follow up with stakeholders through to closure.
• Project manage key risk and governance activities, maintaining plans, milestones and timelines, coordinating dependencies and proactively engaging stakeholders to keep deliverables on track.
• Maintain and enhance the Information Security Policy framework, including reviewing and updating policies and standards to reflect changes in the organisation's risk environment, industry standards
• Regulatory requirements and applicable Mainland China cyber security and data protection requirements.
• Coordinate and operate the Information Security Policy compliance programme, including planning compliance assessments, engaging relevant business and technology stakeholders, identifying and documenting compliance gaps
• Monitoring remediation actions and providing regular reporting on compliance status.
• Monitor developments in information security standards, regulatory requirements and industry practices, assess their implications for existing policies and controls, and coordinate required updates with relevant subject matter experts and stakeholders.
• Build effective relationships and collaborate with IT, Cyber Security, Enterprise Risk, Audit and business stakeholders, providing appropriate 2LOD challenge and ensuring technology risk and information security matters are effectively progressed.
• Define and monitor Key Risk Indicators (KRIs), identify key technology risks for the Club and business lines, and monitor changes in risk posture using KRIs, control assurance results, audit issues and technology and cyber security incidents.
• Develop and deliver regular technology risk reporting, metrics and maturity assessment scorecards to provide management and governance forums with a clear view of the organisation's technology risk and information security posture.
• Support the ongoing development and enhancement of the Technology Risk Management Framework, risk management methodologies, risk treatment practices, risk appetite and tolerance, controls and associated governance processes.
• Support the design and execution of the Control Assurance Programme and other 2LOD assurance activities to assess the design and operating effectiveness of key technology and information security controls.

• A minimum of 10 years' experience in related fields.
• Bachelor and/or Post Graduate degree from a highly accredited University in the discipline of Information Technology, Information Systems or similar.
• Proven track record in leading technology risk and cyber security maturity assessments.
• Experience in large scale IT systems, technology risk management frameworks and information security practices.
• Exposure to legacy and modern platform technologies.

• CISA, CISSP, CRISC or equivalent is preferable.
• Professional/Industry body membership/affiliation is an advantage.

• Competitive salary and benefits package.

• Dynamic working environment.
• Development opportunities.

The Club is Hong Kong's largest single taxpayer and one of the city's major employers, and its Charities Trust is one of the world's leading charity donors.