Company Background

We are a leading Asian investment firm with approximately USD 13 billion in assets under management across our funds.

Our flagship FengHe Asia Fund is recognised as one of the most consistent and best-performing long-short equity funds in Asia.

For more information, please visit

http://www.fengheasia.com

Role & Responsibilities

Managed Services Provider Oversight

1. Act as the firm's primary point of accountability for the outsourced IT provider's security and risk performance
2. Define, negotiate, and enforce SLAs, security requirements, and reporting obligations; review the outsourced IT provider's deliverables, reports, and evidence with a critical eye rather than accepting them at face value
3. Run structured service and risk review meetings with the outsourced IT provider; track open issues, remediation items, and commitments to closure
4. Independently validate the outsourced IT provider's work where warranted. E.g., commissioning third-party penetration tests, reviewing vulnerability scan results, sampling access reviews, and challenging patching and configuration practices
5. Review the outsourced IT provider's assurance materials (SOC 2 reports, certifications, subcontractor arrangements) and assess residual risk to the firm
6. Ensure the firm retains adequate knowledge, documentation, and exit options to avoid unhealthy dependency on any single provider

Cyber Risk Management & Governance

1. Own the firm's cyber and IT risk framework: risk register, risk assessments, key risk indicators, and risk appetite reporting
2. Maintain the firm's information security policies and ensure the outsourced IT provider's operations comply with them
3. Report regularly to senior management (and the board/investors as required) on the firm's cyber risk posture, outsourced IT provider performance, and emerging threats

Incident Leadership

1. Own the firm's incident response plan; ensure the outsourced IT provider's incident processes integrate well with it
2. Lead the firm's response to any cyber incident. Direct and coordinate the outsourced IT provider, brief executives in real time, manage legal/regulatory/insurer notifications, and own investor and counterparty communications
3. Run tabletop exercises involving both the firm and the outsourced IT provider at least annually; drive lessons learned into concrete improvements

Resilience & Awareness

1. Ensure business continuity and disaster recovery arrangements delivered through the provider meet the firm's recovery objectives and are validated through regular testing
2. Run the firm's security awareness program, including phishing simulations and targeted training for high-risk functions

Job Requirements

1. 7+ years in cyber security, technology risk, or IT governance, ideally including experience overseeing managed service providers or outsourced IT arrangements
2. Financial services background strongly preferred (hedge fund, asset manager, fund administrator, or investment bank); familiarity with the outsourced managed-IT model common among hedge funds is a significant advantage
3. Strong technical fluency across the domains typically delivered by an outsourced IT provider: cloud infrastructure, identity and access management, EDR/SIEM, vulnerability management, network security, and backup/DR architectures

Skills & Attributes

1. Sophistication and judgment: strong understanding of what effective security assurance looks like, with the ability to hold a large vendor to a high standard
2. Gravitas and communication: credibly represents the firm in front of investors, regulators, boards, and vendor executives; translates technical risk into commercial language
3. Exceptional attention to detail: thorough in reviewing assurance reports, technical evidence, and documentation, with a strong eye for gaps
4. Composure under pressure: leads decisively during incidents in a high-intensity environment
5. Strong vendor management skills: builds a productive, collaborative working relationship with the provider while maintaining clear accountability
6. High integrity and discretion: handles highly sensitive information appropriately