Senior Manager, IT Governance and Architecture

About West Kowloon Cultural District Authority

The West Kowloon Cultural District Authority welcomes exceptional talent with a passion to realise the vision and mission of making the West Kowloon Cultural District a prime local and international destination for arts, culture and entertainment.

The Senior Manager, IT Governance and Architecture is responsible for leading the Authority’s critical infrastructure and systems protection, and formulating the overall computer system security management plan and operation models as the organization-level security governance framework and managing practices to safeguard the robustness and security of computing systems in the enterprise architecture.

Key Responsibilities of the Senior Manager, IT Governance and Architecture

• Perform and coordinate assessment activities regarding the organization's security posture, against regulatory requirements and industry best practices, to identify areas for improvement.
• Devise and organise effective measures to beef up the current security management landscape, ensuring compliance with legislative and governance requirements including but not limited to critical infrastructure and public-facing IT system protection.
• Act as the contact point with the Commissioner’s Office for Critical Infrastructure Protection, envisioned to be setup under Security Bureau, and other governmental or statutory bodies to facilitate efficacious collaboration and incident reporting between WKCDA and applicable regulatory authorities.
• Establish and maintain a pragmatic incident response plan to effectively manage and mitigate cybersecurity incidents.
• Provide regular updates to IT management regarding the organization's risk posture and cybersecurity incidents.
• Identify stakeholders and manage their expectation through effective communication and relationship management.
• Assess and manage third-party vendors and service providers to ensure they adhere to the organization's cybersecurity standards.
• Organise training activities to promote the value and importance of cybersecurity, ensuring awareness and best practices across the organization.
• Perform any other duties from time to time as reasonably assigned by the Authority.

Qualifications and Experience

• Possess a Bachelor’s degree in Information Technology, Cybersecurity, or a related field; a Master's degree is preferred but not a must.
• Minimum of 10 years of IT experience, including at least 5 years in security governance or management roles, with a demonstrable track record of managing security audits, risk assessments, threat mitigation and incident response processes.
• Have relevant certifications such as CISSP, CISM, CISA, or equivalent.
• Strong knowledge of security frameworks (e.g., NIST, ISO 27001), risk management processes, and current cybersecurity threats and trends.
• Excellent knowledge of applicable laws, regulations, and industry standards related to information and cyber security domains.
• Proven ability to lead and influence team members to achieve common goals.
• Excellent verbal and written communication skills, with the ability to articulate complex technical concepts to non-technical stakeholders.

Key Skills/Competency

• IT Governance
• Cybersecurity
• Risk Management
• Incident Response
• Security Frameworks (NIST, ISO 27001)
• Regulatory Compliance
• Critical Infrastructure Protection
• Vendor Management
• Security Audits
• Stakeholder Management