Manager, Information Security Office

-
Handling Information Security Management, addressing information security threats and incidents, and driving remediation.
-
In conjunction with the Legal team, identify information management and protection laws and regulations and implement actions to ensure compliance with relevant laws.
-
Identify, track, and oversee internal and external compliance and regulatory requirements (PCI, Data Privacy, etc.) for the organization including compliance with established policies, procedures, standards, baselines, and controls.
-
Maintain an information management and protection framework for an effective company-wide governance program.
-
Manage information security awareness programs and provide training to all staff.
-
Guide and support staff, and provide security training and awareness programs to promote a culture of security and best practices within the organization.
-
Manage day-to-day security activities, including conducting vendor security assessments and privacy security assessments, implementing company policies, and communicating related to the information security program.
-
Manage and Support the Information Security requirements across different BUs.
-
Support global projects as a regional ISO team member.
-
Work with security operations team to respond to security incidents (personal/confidential information, system hacking, local employee information leakage, information breach, store physical security, customer center security).
Job Requirements:
-
Degree holder in Management, Information Technology, Information Security, Computer Science, or related disciplines.
-
At least 6 years of experience in information security, cybersecurity, IT risk, or governance-related functions.
-
Strong knowledge of information security governance, risk assessment, compliance frameworks, and data privacy requirements.
-
Familiarity with cybersecurity standards, regulations, and best practices, with the ability to translate security requirements into practical business solutions.
-
Experience managing security controls across Microsoft 365, network, and enterprise technology environments.
-
Professional security certifications (e.g., CISSP, CISM, CISA, GIAC) are highly preferred.
-
Strong analytical thinking, business process improvement, and risk management capabilities.
-
Excellent communication and stakeholder management skills with the ability to influence and educate employees at all levels.
-
Proactive, adaptable, and highly accountable, with the ability to manage multiple projects and priorities independently.
-
Fluent in Cantonese , English and Mandarin.