Information Security Manager

About the role

The Information Security Manager leads the school’s information security function, shaping strategy, governance and risk management. Reporting to the Director of Technology, this senior role partners with infrastructure, client and data services to embed security across the institution.

Key responsibilities

• Define and drive a multi‑year security strategy aligned with the school’s risk profile and regulatory environment.
• Own the security governance framework, policies, and compliance with Hong Kong’s PDPO and cybersecurity insurance requirements.
• Manage external security partners, including the managed SOC, vulnerability assessment and penetration testing providers.
• Lead incident response, maintain playbooks, and ensure timely PDPO breach notifications.
• Oversee identity and access management, MFA deployment, privileged access management and endpoint security.

Required profile

• University degree in Information Security, Computer Science or related field.
• 7+ years of information security experience, with at least 3 years in a leadership or program‑management capacity.
• Professional certifications such as CISSP, CISM, CISA or SANS/GIAC.

Required skills

• Microsoft 365 security ecosystem – Defender, Sentinel, Entra ID.
• MITRE ATT&CK framework knowledge.
• Identity and Access Management (IAM) – MFA, privileged access management.
• Vulnerability scanning and remediation tracking.
• Security Operations Center (SOC) management and incident response.
• Understanding of PDPO or equivalent data‑protection regulations.
• Experience with AI‑driven threat detection and automation tools.