Key Responsibilities

• Lead end-to-end cybersecurity risk assessments across infrastructure, applications, cloud environments, and network ecosystems, identifying vulnerabilities and recommending practical risk mitigation strategies.
• Execute advanced Red Team and Purple Team engagements to emulate real-world cyber threats, validate defensive capabilities, and uncover security weaknesses.
• Drive remediation initiatives by partnering with technical stakeholders to address identified vulnerabilities and improve overall security resilience.
• Advise security and technology teams on the development, implementation, and continuous improvement of cybersecurity policies, standards, procedures, and governance frameworks.
• Assess the design and operational effectiveness of IT security controls, ensuring compliance with organizational and regulatory requirements.
• Coordinate and facilitate internal and external audits, security reviews, and compliance assessments while supporting risk treatment and remediation efforts.
• Strengthen organizational cyber defense capabilities through continuous evaluation of emerging threats, attack techniques, detection mechanisms, and response strategies.
• Act as a trusted advisor to business and technology stakeholders, fostering collaboration and driving security awareness across the organization.

Qualifications & Experience

• Bachelor's or Master's degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, or a related discipline.
• Minimum 5 years of hands-on cybersecurity experience with a strong focus on Red Team operations, Purple Team exercises, penetration testing, and DevSecOps practices.
• Proven experience delivering Hong Kong Security Risk Assessment and Audit (SRAA) engagements, including Security Risk Assessments (SRA), Vulnerability Assessments (VA), and Penetration Testing (PT), aligned with HKSAR Baseline IT Security Policy and G3 Security Guidelines.
• Demonstrable expertise in manual penetration testing of web applications, APIs, mobile platforms, and modern application architectures.
• Solid understanding of information security governance, business continuity management, secure software development, project delivery methodologies, and industry security frameworks.
• Relevant industry certifications are highly desirable, including CISSP, CISA, CISM, OSCP, GPEN, CEH, CRTP, CRT, AAIA, CISP, or equivalent credentials.
• Strong analytical abilities, stakeholder management skills, and the capability to communicate complex security risks to both technical and non-technical audiences.

What Makes an Ideal Candidate

• Hands-on ethical hacker with a strong consulting mindset.
• Comfortable balancing offensive security testing with governance, risk, and compliance requirements.
• Experienced in translating technical findings into actionable business recommendations.
• Able to operate independently while coordinating with cross-functional teams and senior stakeholders.
• Passionate about staying ahead of the evolving cyber threat landscape and emerging security technologies.