Manager, Information Protection Group (MJ008415)

involves close collaboration with regional and global teams to ensure that information security practices support business objectives, meet client expectations and comply with regulatory obligations. Key Responsibilities Manage and maintain information security compliance programmes (ISO 27001, ISO 27701) across China and Hong Kong, coordinate internal/external audits, and ensure findings and corrective actions are resolved within agreed timelines. Assess technology service providers for security and compliance risks, review security-related contract terms and due diligence responses, and monitor remediation actions through completion. Coordinate completion of client security questionnaires and due diligence requests, review client contracts for security requirements, and ensure consistent communication of the firm’s security controls. Coordinate phishing simulations and security awareness campaigns across all business units, develop security communications, and analyse awareness data to drive improvement plans. Coordinate assessment, escalation, and reporting of information security incidents, maintain accurate incident records, and track response and remediation actions to completion, including post-incident reviews. Monitor emerging cybersecurity threats, regulatory developments, and industry best practices; take a hands-on approach to assessing technology controls, identifying gaps, and implementing improvements. Manage competing priorities and deliver assigned work to a high standard within deadlines, while communicating effectively and collaborating with stakeholders across different functions, business units, and locations. Experience & Background Bachelor’s degree in Information Security, Computer Science, Information Technology or a related discipline. Five to eight years of relevant experience in information security, IT risk management, compliance, audit or cybersecurity governance. Strong understanding of information security frameworks, risk management methodologies and technology control environments. Hands-on experience managing ISO 27001 and ISO 27701 compliance programmes and supporting internal and external audits. Experience conducting third-party risk assessments, reviewing vendor security controls and monitoring remediation activities. Experience supporting client security reviews and advising on contractual information security and compliance requirements. Practical understanding of technologies such as generative AI, cloud computing, data analytics, network infrastructure and application security would be a strong advantage. Relevant professional certifications—such as CISA, CISM, CISSP, Certified Information Security Professional (CISP), or an equivalent qualification—are desirable. Strong stakeholder management, communication and report-writing skills, with the ability to work effectively across different functions, business units and locations. Fluency in Cantonese, Mandarin and English. About KPMG At KPMG China, we are committed to being an equal opportunity employer, with zero tolerance for any form of discrimination against any persons. It is important for us to create an inclusive, diverse and agile workplace for our people to develop and thrive at both a personal and professional level. We strive to make ESG (environmental, social and governance) a watermark running through our organisation; from empowering our people to become agents of positive change, to providing better solutions and services to our clients. To lead by example, we launched Our Impact Plan (OIP) which includes our ESG commitments and progress across four key pillars – Planet, People, Prosperity and Governance. We encourage you to come as you are, and we welcome all qualified candidates to apply, and hope you unlock opportunities with us. Visit KPMG China website for more company information. You acknowledge and agree that all personal information hereby provided regarding yourself will be used by KPMG China for its candidate selection purposed only. KPMG China collects, uses, processes, and retains your personal information in accordance with KPMG China's Online Privacy Statement and/or KPMG China Privacy Statement (collectively " Privacy Statement "). During the recruitment process, KPMG China may need to store personal information of candidates in a designated third-party application tracking platform. If you have any questions regarding the information you provided in the form or your job application in general, please contact KPMG China's HR personnel in the location where your application is submitted [ see here ].

, oversee third-party risk management and promote a strong security awareness culture.