Manager, Information Security Office

• Handling Information Security Management, addressing information security threats and incidents, and driving remediation.
• In conjunction with the Legal team, identify information management and protection laws and regulations and implement actions to ensure compliance with relevant laws.
• Identify, track, and oversee internal and external compliance and regulatory requirements (PCI, Data Privacy, etc.) for the organization including compliance with established policies, procedures, standards, baselines, and controls.
• Maintain an information management and protection framework for an effective company-wide governance program.
• Manage information security awareness programs and provide training to all staff.
• Guide and support staff, and provide security training and awareness programs to promote a culture of security and best practices within the organization.
• Manage day-to-day security activities, including conducting vendor security assessments and privacy security assessments, implementing company policies, and communicating related to the information security program.
• Manage and Support the Information Security requirements across different BUs.
• Support global projects as a regional ISO team member.
• Work with security operations team to respond to security incidents (personal/confidential information, system hacking, local employee information leakage, information breach, store physical security, customer center security).

Job Requirements

• Degree holder in Management, Information Technology, Information Security, Computer Science, or related disciplines.
• At least 6 years of experience in information security, cybersecurity, IT risk, or governance-related functions.
• Strong knowledge of information security governance, risk assessment, compliance frameworks, and data privacy requirements.
• Familiarity with cybersecurity standards, regulations, and best practices, with the ability to translate security requirements into practical business solutions.
• Experience managing security controls across Microsoft 365, network, and enterprise technology environments.
• Professional security certifications (e.g., CISSP, CISM, CISA, GIAC) are highly preferred.
• Strong analytical thinking, business process improvement, and risk management capabilities.
• Excellent communication and stakeholder management skills with the ability to influence and educate employees at all levels.
• Proactive, adaptable, and highly accountable, with the ability to manage multiple projects and priorities independently.
• Fluent in Cantonese , English and Mandarin.