Manager Information Security & Governance (Ref:260000IZ)

Requirements

• Degree in Information Technology, Computer Science, or a related discipline 
• Minimum 8 years’ relevant experience, including at least 2 years in a managerial role 
• Professional certifications (ISO, CISSP, CISM, CISA, CRISC) is an advantage
• Solid experience in information security, technology risk management, security risk assessments, and control frameworks (ISO 27001, NIST, COBIT) 
• Exposure to incident response and DLP governance; and regulatory compliance (e.g. Personal Data (Privacy) Ordinance (PDPO), Electronic Transactions Ordinance (ETO), Critical Infrastructure Ordinance (CIO) or similar frameworks) 
• Proven leadership, stakeholder engagement and communication skills 
• Strong command of written and spoken English and Chinese  

Applications

You are invited to apply online via http\://www.mtr.com.hk/mtr_job_en or send in your CV stating the position (with reference number) you are applying for by mail to Human Resource Management Department, MTR Corporation, G.P.O. Box 9916, Hong Kong on or before 13 August 2026.
For other job openings, please visit MTR Corporation's website for more details.
All information provided by applicants will be treated in strict confidence and used for recruitment purpose only. All personal data of unsuccessful applicants will be retained for 12 months for future recruitment purpose and will then be destroyed.

Responsibilities

• Establish and maintain enterprise information security programmes, policies, and governance frameworks across the organization locally and globally, including subsidiaries 
• Deliver the implementation and continuous improvement of corporate cybersecurity governance across business units and technology teams, including monitoring and enhancement of governance metrics (KPIs/KRIs) 
• Drive security awareness programmes and manage phishing simulation campaigns 
• Ensure ISO 27001 compliance and ISMS management, including certification lifecycle activities, audit coordination, risk treatment, and continuous improvement, while managing the team 
• Support and execute Technology Risk Management (TRM) strategy, including security risk assessments, risk analysis, control reviews, and ongoing risk monitoring 
• Ensure governance over Data Loss Prevention (DLP) and data protection controls 
• Support incident response governance and coordinate audits, regulatory reviews, including investigation and remediation recommendations 
• Prepare and deliver senior management reporting materials and presentations