Assurance - Forensic & Integrity Services - Cyber Incident Response - Manager

EY; Hong Kong; On-site; HKD 900,000 - 1,500,000; Full time

Job summary

Ernst & Young Advisory Services Limited - Hong Kong is seeking a Manager to lead cyber incident response engagements, guiding teams through active incidents and coordinating forensic investigations. You will work with executives to assess impact, determine containment and drive recovery activities.

The role requires 5–8 years in cyber incident response, strong leadership and the ability to translate technical findings into clear guidance for senior management.

Qualifications

• Approximately 5–8 years of relevant cyber incident response experience.
• Experience leading cyber incident response engagements including ransomware, data breaches or insider threats.
• Experience coordinating digital forensics investigations and incident communications.

Responsibilities

• Lead cyber incident response engagements for clients during active incidents.
• Coordinate multidisciplinary EY Forensics team to support client response and recovery.
• Develop executive briefings, incident reports and stakeholder communications.

Skills

Cyber incident response

Digital forensics

Project management

Stakeholder management

Executive communication

Job description

Assurance - Forensic & Integrity Services - Cyber Incident Response - Manager - Ernst & Young Advisory Services Limited - Hong Kong

At EY, we’re all in to shape your future with confidence.

We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go.

Join EY and help to build a better working world.

The Opportunity

As a Manager within EY Forensic & Integrity Services, you will join our Cyber Incident Response team and help organizations navigate cyber incidents and technology-related investigations. You will work with clients to assess the nature and impact of cyber events, support cyber breach investigations, coordinate response activities, and enhance organization’s resilience following cyber incidents.

Working alongside cybersecurity, digital forensics, legal, risk, and business stakeholders, you will help clients respond to incidents such as ransomware attacks, data breaches, insider threats, unauthorized system access, and other cybersecurity events. You will lead engagement teams, manage stakeholder communications, and support clients in making informed decisions during critical periods, while helping them strengthen their incident response capabilities and recovery strategies.

Your Key Responsibilities

• Lead cyber incident response engagements for clients during live cyber incidents involving cyber breaches, ransomware attacks, data exfiltration, insider threats, and other cybersecurity events by managing the engagement team to assess the evolving situation, identify key issues, evaluate response options, and coordinate stakeholders.
• Assemble and lead multidisciplinary engagement team within EY Forensics comprising cyber security, digital forensics, forensic accounting, investigations, and crisis management specialists to support client response, investigation, and recovery activities.
• Lead and oversee digital forensic investigations, including evidence preservation, forensic imaging, forensic data collection, log analysis, timeline reconstruction, root cause determination, and assessment of potential data compromise or exfiltration.
• Coordinate forensic analysis activities across endpoints, servers, cloud environments, mobile devices, email systems, and other relevant technology platforms to determine the scope and impact of cyber incidents.
• Assess the nature and extent of compromised systems, accounts, and data, and support clients in making informed decisions regarding containment, eradication, recovery, and remediation activities.
• Conduct cyber incident impact assessments, including analysis of operational, regulatory, financial, and reputational implications.
• Support clients in determining whether sensitive, personal, confidential, or regulated data has been accessed, compromised, or exfiltrated, and assist with associated stakeholder and regulatory response considerations.
• Develop executive briefings, incident reports, action trackers, investigation findings, and decision-support materials for senior management, legal counsel, regulators, and other stakeholders.
• Work closely with client stakeholders including executive leadership teams, Legal, Risk, Compliance, Communications, Privacy, Human Resources, Information Security, and Technology functions throughout incident response and recovery activities.
• Support recovery planning and remediation initiatives following cyber incidents, including identification of control enhancements and lessons learned.
• Conduct post cyber incident reviews and root cause assessments to identify opportunities for strengthening cyber security and incident response capabilities.
• Manage project delivery, budgets, timelines, and engagement teams to ensure high-quality outcomes.
• Contribute to proposal development, business development initiatives, thought leadership, and growth of the Cyber Incident Response practice.
• Coach and develop junior team members and contribute to capability development within the team.

Skills and Attributes for Success

• Strong understanding of cyber incident response, digital forensics, cyber investigations, information security, or technology risk.
• Ability to translate technical, cyber investigation findings into clear and actionable insights for senior management and other non-technical stakeholders.
• Strong analytical and problem-solving skills, with the ability to assess complex technical and business issues and develop practical response strategies.
• Experience managing multiple stakeholder groups and balancing technical, legal, regulatory, and business considerations during cyber incidents.
• Excellent written and verbal communication skills, including the ability to prepare and present executive-level materials internally within EY and externally to our clients.
• Ability to remain calm and effective in high-pressure and rapidly evolving situations.
• Strong project management and team leadership capabilities.
• Strong relationship-building, stakeholder management, and facilitation skills.

To qualify for the role you must have

• Approximately 5 to 8 years of relevant experience in cyber incident response, digital forensics, cyber investigations, cybersecurity, technology risk, information security, or related disciplines.
• Experience managing cyber incident response engagements involving ransomware attacks, data breaches, unauthorized access incidents, insider threats, or other cybersecurity events.
• Experience overseeing or coordinating digital forensic investigations, including evidence preservation, forensic imaging, log analysis, root cause investigations, and assessment of potential data compromise.
• Experience preparing executive briefings, investigation reports, incident updates, and stakeholder communications relating to cyber incidents.
• Experience working with senior client stakeholders across Information Security, Technology, Risk, Legal, Compliance, Privacy, or other business functions.
• Working knowledge of cyber security and cyber incident response frameworks and standards such as ISO 27001 (Information Security Management Systems), ISO / IEC 27035 (Information Security Incident Management) or similar, but not mandatory.
• Professional certifications such as Security+, GCIH, GCFA, CHFI, EnCE, CISM, CISSP or equivalent are advantageous.

What we offer you

At EY, we’ll develop you with future-focused skills and equip you with world-class experiences. We’ll empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams.

To help create an equitable and inclusive experience during the recruitment process, please inform us as soon as possible about any disability-related adjustments or accommodations you may need.

EY | Building a better working world

EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.

Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.

EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.