Our client is seeking a Cybersecurity Consultant to support security assessment and assurance initiatives for public sector projects. This role will be responsible for conducting security risk assessments, vulnerability assessments, penetration testing activities, and providing remediation recommendations in accordance with Hong Kong Government security standards.

This is an excellent opportunity for cybersecurity professionals with experience in Security Risk Assessment and Audit (SRAA), vulnerability assessment, penetration testing, and government security frameworks.

• Conduct Security Risk Assessment and Audit (SRAA) engagements for client systems and applications.
• Perform and support vulnerability assessments and penetration testing activities.
• Identify security risks, vulnerabilities, and control gaps, and provide practical remediation recommendations.
• Review system architectures, security controls, and operational processes against established security requirements.
• Prepare security assessment reports and present findings to stakeholders.
• Support audit and compliance activities related to cybersecurity controls.
• Collaborate with internal teams and clients to improve overall security posture.
• Ensure assessments are conducted in alignment with the HKSAR Baseline IT Security Policy and G3 Practice Guide.

• Degree in Cybersecurity, Information Technology, Computer Science, or a related discipline.
• Minimum 3 years of experience in cybersecurity, information security, or security consulting.
• Hands-on experience in Security Risk Assessment and Audit (SRAA), vulnerability assessment, and penetration testing.
• Familiarity with the HKSAR Baseline IT Security Policy and G3 Practice Guide.
• Experience preparing security assessment reports and remediation recommendations.
• Strong understanding of information security principles, risk management, and security controls.
• Good communication and stakeholder management skills.
• Fluent Cantonese is required.

• Experience supporting Hong Kong Government or public sector projects.
• Relevant certifications such as CISSP, CISA, CISM, CEH, OSCP, CRT, or equivalent.
• Exposure to web application, API, or mobile application security testing.