Senior Manager, Information Security Risk and Assurance (1-year Contract)

The Hong Kong Jockey Club

Founded in 1884, The Hong Kong Jockey Club ("the Club") is a world-class horse sports and entertainment organisation that acts continuously for the betterment of our society. The Club has a unique value creation model, through which the Club generates sustainable economic and social value for the benefit of the community and supports the HKSAR Government in combatting illegal gambling. The Club is Hong Kong’s largest single taxpayer and one of the city’s major employers. Its Charities Trust is one of the world’s leading charity donors.

The Division

The Security, Integrity and Information Security (SIIS) Division is responsible for the Club’s integrity by combatting criminality, corruption, and information security risks, including cyber security that may impact business. Through robust governance and proactive security measures, SIIS is dedicated to maintaining a secure environment and upholding uncompromising integrity across Club operations.

The Job

• Coordinate and support the end-to-end operation of Technology Risk committees and governance forums, including forward agenda planning, coordinating papers and presenters, preparing meeting materials, managing timelines and ensuring governance deliverables are completed to a high standard.
• Develop and support high-quality committee papers, management reports and PowerPoint presentations, translating complex technology risk and information security matters into clear, concise and visually effective materials for senior management and governance forums.
• Prepare accurate and concise meeting minutes, capturing key discussions, decisions and actions, and maintain action logs to proactively follow up with stakeholders through to closure.
• Project manage key risk and governance activities, maintaining plans, milestones and timelines, coordinating dependencies and proactively engaging stakeholders to keep deliverables on track.
• Maintain and enhance the Information Security Policy framework, including reviewing and updating policies and standards to reflect changes in the organisation’s risk environment, industry standards, regulatory requirements and applicable Mainland China cyber security and data protection requirements.
• Coordinate and operate the Information Security Policy compliance programme, including planning compliance assessments, engaging relevant business and technology stakeholders, identifying and documenting compliance gaps, monitoring remediation actions and providing regular reporting on compliance status.
• Monitor developments in information security standards, regulatory requirements and industry practices, assess their implications for existing policies and controls, and coordinate required updates with relevant subject matter experts and stakeholders.
• Build effective relationships and collaborate with IT, Cyber Security, Enterprise Risk, Audit and business stakeholders, providing appropriate 2LOD challenge and ensuring technology risk and information security matters are effectively progressed.
• Define and monitor Key Risk Indicators (KRIs), identify key technology risks for the Club and business lines, and monitor changes in risk posture using KRIs, control assurance results, audit issues and technology and cyber security incidents.
• Develop and deliver regular technology risk reporting, metrics and maturity assessment scorecards to provide management and governance forums with a clear view of the organisation’s technology risk and information security posture.
• Support the ongoing development and enhancement of the Technology Risk Management Framework, risk management methodologies, risk treatment practices, risk appetite and tolerance, controls and associated governance processes.
• Support the design and execution of the Control Assurance Programme and other 2LOD assurance activities to assess the design and operating effectiveness of key technology and information security controls.

About You

• A minimum of 10 years’ experience related fields.
• Bachelor and / or Post Graduate degree from a highly accredited University in the discipline of Information Technology, Information Systems or similar.
• Proven track record in leading technology risk and cyber security maturity assessments.
• Experience in large scale IT systems, technology risk management frameworks and information security practices.
• Exposure to legacy and modern platform technologies.
• CISA, CISSP, CRISC or equivalent is preferable.
• Professional/Industry body membership/affiliation is an advantage.

Apply Now!

We offer competitive salary and benefits packages, dynamic working environment and development opportunities.
Add horsepower to your career today. Click the “Apply Now” button to create an account and submit your application.

Equal Opportunity and Inclusive Hiring

We are an equal opportunity employer and strive to create an inclusive workplace for all. Applicants from diverse backgrounds are welcomed to apply. If you have any special needs or require accommodations during the interview process, please e-mail us via careers@hkjc.org.hk. 

Personal data provided by job applicants will be used strictly in accordance with the Club's notice to employees and job applicants relating to the Personal Data (Privacy) Ordinance. A copy of which will be provided immediately upon request.