We are seeking a Cybersecurity Manager to join Manulife Financial Corporation (MFC) under the Asia CISO organization. This role reports directly to the Asia Regional Office Security Officer and will serve as a Cybersecurity Manager within the BUSO Center of Excellence (BUSO CoE) . The BUSO CoE , operating under the Asia CISO division, is dedicated to supporting Market Business Unit Security Officers (BUSOs) with specialized cybersecurity and technology control activities. The team partners closely with regional leaders and in‑country BUSOs to deliver core control execution, process improvements, and project‑driven initiatives. This includes reviewing high‑risk service requests, handling cyber incident per global process and regulatory expectations, conducting information security risk assessments, and executing, automating, and operationalizing foundational security processes.
Position Responsibilities:
Lead and perform end-to-end Project Information Risk Assessments across Asia markets , from initial scoping and information criticality assessment through risk identification, control evaluation, risk treatment, remediation tracking, and business risk acceptance.
Review assessments completed by market or designated assessors to ensure the consistent application of risk methodologies, control requirements, documentation standards, and quality expectations.
Analyze project designs, architectures, data flows, technology components, third-party arrangements, and applicable security requirements to identify information security and operational risks.
Translate assessment findings into clear risk statements and practical recommendations; advise project, technology, and business stakeholders on appropriate mitigation strategies and compensating controls.
Monitor risk-treatment plans, commitments, exceptions, and risk acceptances; maintain assessment schedules and records, follow up on overdue actions, and escalate material or unresolved risks through the appropriate governance channels.
Develop and maintain the regional information risk assessment framework, including playbooks, templates, procedures, training materials, quality assurance plans, standardized reporting, performance measures, and mechanisms for sharing best practices.
Promote the information risk assessment program across Asia markets and provide guidance to market BUSOs, assessors, project teams, and other stakeholders to strengthen risk ownership and assessment quality.
Provide application and information security consultation to project teams, technology partners, and business stakeholders, including facilitating specialized security assessments when required.
Partner with market BUSOs and relevant control functions to identify operational security and risk-management activities suitable for centralization, standardization, automation, or transition to the CoE.
Establish and maintain effective governance for CoE services, including service scope, roles and responsibilities, onboarding and offboarding procedures, reporting, service measures, issue management, and escalation paths.
Deliver assigned centralized security and operational risk activities consistently and within agreed service expectations, including analysis of high-risk service requests and support for other BAU control processes.
Support the end-to-end management and timely resolution of security incidents, particularly Data Loss Prevention incidents, in coordination with market BUSOs and relevant response teams.
Provide regular status, risk, and performance updates to market BUSOs and regional stakeholders, highlighting key findings, trends, overdue actions, emerging risks, and matters requiring decision or escalation.
Conduct knowledge transfer, coaching, and knowledge-sharing sessions for new team members, market assessors, and IT control and governance teams.
Contribute to continuous improvement initiatives that enhance the effectiveness, efficiency, scalability, and consistency of regional security…