IT Audit & Advisory – Technology Risk Specialist (All Levels)

About the role

As a technology risk specialist at EY, you will guide financial‑sector clients in Hong Kong and the Greater Bay Area to manage technology risks, meet regulatory requirements and strengthen cybersecurity postures.

Key responsibilities

• Conduct technology compliance reviews for banking, wealth, asset management and insurance institutions across Hong Kong and the Greater Bay Area.
• Analyse client IT environments, identify risks, evaluate controls—including cloud security—and ensure alignment with regulatory requirements and industry standards.
• Act as licensing advisor, helping clients navigate technology risk aspects of financial activity licensing.
• Assess and implement information security management frameworks such as ISO, NIST, COBIT and SANS.
• Develop holistic governance and incident‑management frameworks and advise on emerging technologies like blockchain, AI/ML and big data.
• Perform vulnerability scanning, penetration testing and cyber‑attack simulations to validate control effectiveness.
• Deliver information‑security awareness training and support the creation of security strategy plans.
• Mentor junior team members, contribute to proposals and maintain client relationships using project‑management principles.

Required profile

• Bachelor’s or master’s degree in Information Security, Computer Science, Engineering or related fields.
• Relevant experience in technology risk, IT audit or cybersecurity, with hands‑on exposure to compliance reviews and risk assessments.
• Professional certifications such as CISA, CISM or CISSP; additional certifications (CRTP, CRTE, OSCP, GPEN, GXPN, cloud‑related) are valued.
• Strong written and spoken English and Chinese; Mandarin is a plus.
• Proficiency with Microsoft Office tools (Word, Excel, PowerPoint, Visio).

Required skills

• CISA, CISM, CISSP certifications.
• Cloud security and related certifications.
• Experience with ISO, NIST, COBIT, SANS frameworks.
• Vulnerability scanning, penetration testing, cyber‑attack simulation.
• Knowledge of blockchain, virtual assets, AI/ML, big data security.

What we offer

• Competitive performance‑based compensation.
• Coaching, feedback and development from senior colleagues.
• Opportunities to acquire new skills and advance your career.
• Flexibility to manage your role in a way that suits you.