Information Security Officer - Mandarin Speaking

Reporting to the Senior Information Security Manager, the Information Security Officer for Asia will play a key role in maintaining the firm's ISO 27001 certification across its offices in Asia (Hong Kong and Beijing). This is a new role, based in London, that will primarily be responsible for the day-to-day management, administration and continual improvement of the Asia Information Security Management System (ISMS).

For more information please click here

Full job description (attached PDF)

Role overview

Reporting to the Senior Information Security Manager, the Information Security Officer for Asia will play a key role in maintaining the firm's ISO 27001 certification across its offices in Asia (Hong Kong and Beijing). This is a new role, based in London, that will primarily be responsible for the day-to-day management, administration and continual improvement of the Asia Information Security Management System (ISMS).

This is a hands-on individual contributor role, requiring a strong understanding of the ISO 27001 standard and the ability to work independently, building strong relationships with stakeholders across both Europe and Asia offices. The role will help ensure that information security practices in Asia remain aligned with both the firm's global standards and applicable local regulatory requirements.

The role will also provide security oversight and guidance for projects, technology changes, and operational activities across the firm's Asia offices, ensuring that information security risks are managed effectively. A strong background in information security Governance, Risk and Compliance (GRC) is essential.

The role requires fluency in both English and Mandarin, with Cantonese considered beneficial. Occasional travel to Hong Kong and Beijing will be required, typically two to four trips per year, each lasting several days. Given the requirement to collaborate regularly with colleagues across Asia, some flexibility in working hours is desirable, for example 8:00am to 4:00pm UK time.

Key responsibilities

The key responsibilities of this role are set out below and there may be others which are not listed. You may be required on occasion to work outside our normal working hours of 9:30am to 5:30pm.

• Manage the day-to-day operations of the firm's Asia ISMS by:
• Maintaining policies such that they align with the firm's global standards but reflect local variations in both the regulatory landscape and working practice.
• Maintain and continuously improve risk, incident and exceptions registers.
• Track relevant metrics against ISMS objects and produce management review reports for Steering Group meetings.
• Coordinate and facilitate internal and external ISO 27001 audits for the Hong Kong and Beijing offices, managing audit schedules, stakeholder engagement, and the completion of audit deliverables.
• Coordinate with relevant Business Services teams and stakeholders to develop, implement, and monitor remediation plans for audit findings, and drive continuous improvement.
• Collaborate with the wider Information Security and Privacy (ISP) team to support the delivery of information security awareness and training programmes, promoting a strong security culture across the Hong Kong and Beijing offices.
• Provide advice and support to the Hong Kong and Beijing offices, as their primary information security representative.

Candidate profile

Candidates for this position must have:

• Strong working knowledge of ISO 27001, e.g. ISO 27001 Lead Implementer or Lead Auditor.
• Prior experience in an information security or GRC role, ideally within a regulated environment or an organisation aligned to ISO 27001.
• A self-motivated, results-driven mindset with a strong sense of ownership and accountability.
• Excellent organisational skills, with the ability to prioritise effectively in a fast-paced environment.
• Proven ability to collaborate effectively, build strong professional relationships, and communicate confidently with senior leadership.
• Fluent in both English and Mandarin. Cantonese speaking beneficial.
• Ability and willingness to travel to Hong Kong and Beijing, typically two to four trips per year

Our recruitment process

We anticipate this being a two-stage process:

1st interview - Head of Information Security and Senior Information Security Manager

Practical assessment - Chief Information Security Officer and Chief Operating Officer - Asia

We are committed to ensuring that our recruitment processes are barrier-free and as inclusive as possible for everyone. This includes making adjustments for people who have a disability or long-term condition. If you have any questions or require any adjustments to be made to one or both of the application or interview processes, please contact the Recruitment Team.

We are a Disability Confident Committed employer and will offer an interview to applicants with a disability or long-term condition who best meet the minimum or essential criteria for our Business Services roles. If you would like to apply through the Disability Confident 'Offer An Interview' commitment, please apply via our online application form and not via LinkedIn. You are disabled under the Equality Act 2010 if you have a physical or mental impairment that has a 'substantial' and 'long-term' negative effect on your ability to do normal daily activities. For more information about the Disability Confident scheme, please see the government website here.

We welcome applications irrespective of race, colour, ethnic or national origin, disability, sex, gender identity, sexual orientation, age, religion, belief or marital status.

The purpose of this description is to provide guidance in relation to the general requirements of the position referred to. It is by no means an exhaustive list of the responsibilities that will be involved.

Any offer of employment with us is subject to the firm's receipt of a satisfactory report from its third party screening and vetting provider in respect of the successful candidate. Your adviser will be able to explain how this process works in practice in the event of any questions.

At Slaughter and May, we take the protection of your personal information seriously and we are committed to safeguarding the privacy of the personal information that you share with us, or is collected by us, during the course of our interactions with you. Our Recruitment Privacy Notice ("RP Notice") supplements, and should be read alongside, the firm's Privacy Notice.

These privacy notices are always available to view within the Legal and Regulatory section of our website.

Who we are

Slaughter and May is a leading international law firm, recognised throughout the business community for its exceptional legal service, commercial awareness, and commitment to clients. We advise across the spectrum of legal matters including high-profile, ground-breaking, and complex transactions, contentious matters and all aspects of risk. We deliver innovative and bespoke solutions to our clients, domestically and internationally. We provide clear legal advice that spans the globe whilst tackling the cultural nuances between jurisdictions. Our lawyers understand how to coordinate and manage matters in the jurisdictions most relevant to our clients.

Excellence is central to everything we do, and it remains one of the first words mentioned when others are asked about the firm. We are very proud of that reputation. One reason we are known for excellence is because we have always been guided by a set of values that have been an implicit part of who we are and how we operate.

Our four core values are:

1. The highest standards;

2. Independence of thought;

3. Collective endeavour;

4. Respect for all.

They are not simply a list of characteristics. They are part of a framework, as they demonstrate our commitment to our four stakeholder groups (Our clients; Our people; The firm; Society).

At Slaughter and May, with over 1,400 partners and staff worldwide, everyone's contribution is valued, and we all enjoy an open, friendly and supportive environment. We have an underlying sense of pride in who we are and what we do, and our inclusive culture gives rise to a unique diversity of thinking, which is critical to our success and helps maintain our position as a true market leader.

Business Services Development

We offer a variety of learning and development opportunities to members of our Business Services team, including sessions open to everyone on topics ranging from personal impact and resilience to written communication. We also run a series of development programmes for supervisors and managers, as well as various bespoke team and one-to-one sessions.

Our Network of Networks

The firm has eleven employee networks run by employees and supported by partners. Collectively, we form a Network of Networks, and our aim is to foster a spirit of inclusion, both amongst the networks and the firm more widely. We work collaboratively to create a more open minded and inclusive work environment.

We strive to make people feel comfortable about bringing their authentic selves to work.

Each network offers an informal support mechanism for employees with shared backgrounds, perspectives or interests and hosts a number of exciting formal and informal events throughout the year, which are open to everyone. They're a great way to meet new people in the firm, as well as to celebrate difference and learn about a variety of experiences and perspectives.