Manager, Information Security Office

About the role

fastretailing is looking for a Manager, Information Security Office to lead its information security programme. The role covers handling security threats and incidents, driving remediation, ensuring compliance with laws and regulations, and building a company-wide governance and awareness programme.

Key responsibilities

• Handle information security management, threats and incidents, and drive remediation.
• With the Legal team, identify information management and protection laws and regulations and implement actions to ensure compliance.
• Track and oversee internal and external compliance and regulatory requirements (PCI, data privacy, etc.), including policies, procedures, standards, baselines and controls.
• Maintain an information management and protection framework supporting an effective company-wide governance programme.
• Manage information security awareness programmes and provide training to all staff, promoting a culture of security and best practices.
• Manage day-to-day security activities, including vendor and privacy security assessments, implementation of company policies and communication on the security programme.
• Support information security requirements across different business units and act as a regional ISO team member on global projects.
• Work with the security operations team to respond to security incidents such as personal or confidential information breaches, system hacking, employee information leakage, and store and customer centre physical security issues.

Required profile

• Degree in Management, Information Technology, Information Security, Computer Science or a related discipline.
• At least 6 years of experience in information security, cybersecurity, IT risk or governance-related functions.
• Fluent in Cantonese, English and Mandarin.
• Professional security certifications (e.g. CISSP, CISM, CISA, GIAC) are highly preferred.

Required skills

• Strong knowledge of information security governance, risk assessment, compliance frameworks and data privacy requirements.
• Familiarity with cybersecurity standards, regulations and best practices, able to turn security requirements into practical business solutions.
• Experience managing security controls across Microsoft 365, network and enterprise technology environments.
• Analytical thinking, business process improvement and risk management capabilities.
• Excellent communication and stakeholder management skills, and the ability to manage multiple projects independently.