Cybersecurity Consultant – Penetration Testing & VAPT

About the role

We are seeking a Cybersecurity Consultant to deliver hands‑on security services to clients in Hong Kong. The role focuses on penetration testing, vulnerability assessments, and clear communication of findings to customers.

Key responsibilities

• Deliver cybersecurity service projects including penetration testing, VAPT, web and API security assessments, infrastructure security assessments, vulnerability scanning, and configuration reviews.
• Independently perform security testing, analyse vulnerabilities and attack paths, assess business impact, and produce professional client‑facing reports.
• Communicate findings and remediation recommendations clearly, follow up on remediation progress, and conduct verification testing when required.
• Collaborate with customer technical and management teams throughout project kickoff, execution, reporting, presentation, and closure.
• Maintain high standards of delivery quality, documentation, evidence collection, project timelines, and overall customer experience.
• Support project scoping, technical discussions, effort estimation, and pre‑sales activities as needed.

Required profile

• Minimum 3 years of hands‑on experience in penetration testing, VAPT, security assessment, offensive security, or cybersecurity consulting.
• Strong practical experience across web applications, APIs, networks, infrastructure, cloud environments, or internal systems.
• Ability to produce clear, client‑ready technical reports in English or Chinese.
• Fluent Cantonese required; professional fluency in English or Mandarin also required.
• Excellent customer communication, problem‑solving, project execution, and documentation skills.
• Legal right to work in Hong Kong; experience with Hong Kong government, financial institutions, public organisations, technology companies, or large enterprises is a plus.

Required skills

• Penetration testing
• Vulnerability assessment and testing (VAPT)
• Web application and API security
• Network and infrastructure security
• Cloud security
• Vulnerability scanning
• Configuration review
• Technical reporting