IT and Cybersecurity Advisory – Associate / Senior Associate

Key Responsibilities

• Perform cybersecurity, privacy, and technology risk assessments aligned with international frameworks and standards (e.g., ISO/IEC 27001, ISO 22301, SOC 2, SRAA, PIA).

• Assist clients in designing, implementing, and maintaining Information Security Management Systems (ISMS).

• Advise clients on regional regulatory compliance obligations (e.g., HKMA/SFC guidance, PDPO, Protection of Critical Infrastructures Ordinance) and develop clear remediation roadmaps.

• Conduct Vulnerability Assessments and Penetration Testing (VAPT) across web, mobile, network, cloud, and enterprise environments.

• Execute threat simulations, including Red/Blue/Purple teaming exercises, social engineering, email phishing assessments, and source code reviews.

• Evaluate cloud and on-premise IT architectures and security configurations (e.g., Active Directory, PAM/IAM, WAF, Endpoint Protection).

• Support clients in threat monitoring, incident response triage, containment, and post-incident reviews.

• Respond to client security due diligence inquiries, vendor risk assessments, and regulatory audits.

• Prepare executive-ready client deliverables, including risk control matrices, technical VAPT reports, security policies, and management presentations.

• Leverage AI tools and automation to streamline security monitoring, risk assessments, and advisory delivery.

• Research emerging cyber threats, regulations, and technologies (e.g., AI automation, Web3, Blockchain).

Key Requirements

• Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related STEM discipline.

• 1–3 years of experience in cybersecurity, security operations, IT audit, or technical risk advisory.

• Strong analytical, problem-solving, and communication skills; ability to explain technical risks to non-technical stakeholders.

• Excellent command of written and spoken English; proficiency in Cantonese and/or Mandarin is preferred.

• Collaborative mindset with strong curiosity about emerging technologies.

• Holds one or more recognized professional certifications:

  • GRC / Management: CISSP, CISM, CISA, CRISC, CIPP, or ISO 27001 Lead Auditor/Implementer.
  • Technical / Offensive Security: OSCP, CREST, GPEN, GWAPT, OSCE, or equivalent.