Cyber Security Penetration Testing Consultant – Hong Kong

About the role

EY is looking for a Consultant or Senior Consultant to join its Cyber Security practice in Hong Kong. You will help clients protect their applications and infrastructure by delivering high‑impact penetration testing and red‑team engagements.

Key responsibilities

• Lead a team to perform vulnerability scanning and penetration testing of web, mobile (Android/iOS), API, network and thick‑client applications.
• Prepare and review testing reports and findings tracker sheets using EY templates.
• Design and execute intelligence‑led cyber‑attack simulations and red‑team operations.
• Communicate findings to client stakeholders and guide remediation efforts.
• Research emerging threats, security best practices, and stay current on new vulnerabilities.
• Coach and mentor junior team members on penetration testing and red‑team techniques.
• Participate in fast‑paced delivery across other cyber‑security domains and support project and team management.

Required profile

• College degree or equivalent.
• Minimum 5 years of hands‑on penetration testing experience.
• One of the following certifications: OSCP, CREST, GPXN, GPEN or equivalent.
• Strong track record delivering penetration testing and red‑team projects.
• Excellent written and oral English; Cantonese is a plus.

Required skills

• Penetration testing and red‑team methodologies.
• Vulnerability scanning tools such as Nessus, AppScan, Acunetix, Burp Suite Pro, WebInspect.
• Risk rating standards like DREAD and CVSS.
• Static and dynamic secure code review.
• Application security architecture assessment.
• Threat intelligence and threat modeling.

What we offer

• Exposure to leading financial services organisations.
• Opportunities to develop new technical skills and innovate on security solutions.
• Collaborative, inclusive work environment that values diversity.