Senior Consultant – Penetration Testing & Purple Team (Hong Kong)

About the role

Join EY's Technology Risk and Cyber Team and become a key player in defending against cyber threats. As a Senior Consultant, you will work with top‑tier talent in a collaborative environment, tackling complex cybersecurity challenges and simulating real‑world cyber‑attacks. You will guide clients to manage technology risks, comply with regulatory requirements, and strengthen their cybersecurity posture.

Key responsibilities

• Conduct Technology Compliance Reviews for banking, wealth, asset management and insurance institutions across Hong Kong and the Greater Bay Area.
• Deliver independent IT Risk Assurance audits of financial systems to ensure integrity and compliance.
• Analyze IT environments, identify risks and evaluate controls (including cloud security) against regulatory requirements and best practices.
• Perform vulnerability assessments and penetration testing to uncover security weaknesses.
• Simulate real‑world cyber‑attacks to identify vulnerabilities and recommend improvements.
• Review IT system architectures and configurations for security gaps.
• Respond promptly to security incidents and support clients in breach recovery.

Required profile

• Bachelor’s or Master’s degree in Information Security, Computer Science, Engineering or related fields.
• 1‑4 years of experience in penetration testing, offensive security assessments or Purple Team engagements (consulting experience preferred).
• Industry‑recognized certifications such as OSCP, OSWE, OSEP, OSEE, GPEN, CRTO, GXPN, CRTP or CRTE (or actively pursuing).
• Strong knowledge of security frameworks and attack models (e.g., OWASP, MITRE ATT&CK, NIST, ISO).
• Hands‑on experience with tools like Burp Suite, Nmap, Metasploit, Nessus, Cobalt Strike, BloodHound and PowerShell.
• Understanding of TCP/IP, DNS, VPNs, firewalls and network protocols, as well as cloud security and secure development practices.
• Familiarity with Windows and Linux environments, Active Directory attacks, lateral movement and persistence techniques.
• Experience in incident response, threat hunting, malware analysis and digital forensics.

Required skills

• OSCP, OSWE, OSEP, OSEE, GPEN, CRTO, GXPN, CRTP, CRTE certifications.
• OWASP, MITRE ATT&CK, NIST, ISO frameworks.
• Burp Suite, Nmap, Metasploit, Nessus, Cobalt Strike, BloodHound, PowerShell.
• TCP/IP, DNS, VPN, firewalls, network protocols.
• Cloud security, secure development practices.
• Windows, Linux, Active Directory.
• EDR, DLP, UEBA, SIEM, SOAR platforms.
• SQL, Python (or other programming languages).