Assurance - Forensics - Cyber Incident Response - Manager - Ernst & Young - Hong Kong

EY; Hong Kong; On-site; HKD 800,000 - 1,100,000; Full time

Job summary

EY is seeking a Manager in the Forensic & Integrity Services’ Cyber Incident Response team in Hong Kong. You will lead live cyber incident engagements, coordinate cross-functional investigations, and guide clients through containment, eradication, and recovery activities.

The role requires strong leadership, communication, and stakeholder management in a fast-paced environment. You will collaborate with cybersecurity, digital forensics, legal, risk, and business teams to deliver high-impact

Qualifications

• Approximately 5 to 8 years of relevant experience in cyber incident response, digital forensics, cyber investigations, cybersecurity, technology risk, information security, or related disciplines.
• Experience leading cyber incident response engagements involving ransomware attacks, data breaches, unauthorized access incidents, or insider threats.
• Experience coordinating digital forensic investigations and preparing executive briefings and stakeholder communications.

Responsibilities

• Lead cyber incident response engagements for clients during live cyber incidents by managing the engagement team and coordinating stakeholders.
• Assemble and lead multidisciplinary teams to support client response, investigation, and recovery activities.
• Oversee digital forensic investigations including evidence preservation, imaging, log analysis, and root cause assessment.
• Coordinate forensic analysis across endpoints, servers, cloud environments, and other platforms to determine impact.
• Develop executive briefings, incident reports, and decision-support materials for senior management and regulators.
• Manage project delivery, budgets, timelines, and engagement teams to ensure outcomes.

Skills

Cyber incident response

Digital forensics

Cyber investigations

Information security

Stakeholder management

Project management

Leadership

Communication

Education

Bachelor's degree in a relevant field

Professional certifications e.g. CISSP (advantageous)

Tools

Forensic imaging tools

Log analysis tools

Incident management platforms

Job description

At EY, we’re all in to shape your future with confidence.

We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go.

Join EY and help to build a better working world.

The Opportunity

As a Manager within EY Forensic & Integrity Services, you will join our Cyber Incident Response team and help organizations navigate cyber incidents and technology-related investigations. You will work with clients to assess the nature and impact of cyber events, support cyber breach investigations, coordinate response activities, and enhance organization’s resilience following cyber incidents.

Working alongside cybersecurity, digital forensics, legal, risk, and business stakeholders, you will help clients respond to incidents such as ransomware attacks, data breaches, insider threats, unauthorized system access, and other cybersecurity events. You will lead engagement teams, manage stakeholder communications, and support clients in making informed decisions during critical periods, while helping them strengthen their incident response capabilities and recovery strategies.

Your Key Responsibilities

• Lead cyber incident response engagements for clients during live cyber incidents involving cyber breaches, ransomware attacks, data exfiltration, insider threats, and other cybersecurity events by managing the engagement team to assess the evolving situation, identify key issues, evaluate response options, and coordinate stakeholders.
• Assemble and lead multidisciplinary engagement team within EY Forensics comprising cyber security, digital forensics, forensic accounting, investigations, and crisis management specialists to support client response, investigation, and recovery activities.
• Lead and oversee digital forensic investigations, including evidence preservation, forensic imaging, forensic data collection, log analysis, timeline reconstruction, root cause determination, and assessment of potential data compromise or exfiltration.
• Coordinate forensic analysis activities across endpoints, servers, cloud environments, mobile devices, email systems, and other relevant technology platforms to determine the scope and impact of cyber incidents.
• Assess the nature and extent of compromised systems, accounts, and data, and support clients in making informed decisions regarding containment, eradication, recovery, and remediation activities.
• Conduct cyber incident impact assessments, including analysis of operational, regulatory, financial, and reputational implications.
• Support clients in determining whether sensitive, personal, confidential, or regulated data has been accessed, compromised, or exfiltrated, and assist with associated stakeholder and regulatory response considerations.
• Develop executive briefings, incident reports, action trackers, investigation findings, and decision-support materials for senior management, legal counsel, regulators, and other stakeholders.
• Work closely with client stakeholders including executive leadership teams, Legal, Risk, Compliance, Communications, Privacy, Human Resources, Information Security, and Technology functions throughout incident response and recovery activities.
• Support recovery planning and remediation initiatives following cyber incidents, including identification of control enhancements and lessons learned.
• Conduct post cyber incident reviews and root cause assessments to identify opportunities for strengthening cyber security and incident response capabilities.
• Manage project delivery, budgets, timelines, and engagement teams to ensure high-quality outcomes.
• Contribute to proposal development, business development initiatives, thought leadership, and growth of the Cyber Incident Response practice.
• Coach and develop junior team members and contribute to capability development within the team.

Skills and Attributes for Success

• Strong understanding of cyber incident response, digital forensics, cyber investigations, information security, or technology risk.
• Ability to translate technical, cyber investigation findings into clear and actionable insights for senior management and other non-technical stakeholders.
• Strong analytical and problem-solving skills, with the ability to assess complex technical and business issues and develop practical response strategies.
• Experience managing multiple stakeholder groups and balancing technical, legal, regulatory, and business considerations during cyber incidents.
• Excellent written and verbal communication skills, including the ability to prepare and present executive-level materials internally within EY and externally to our clients.
• Ability to remain calm and effective in high-pressure and rapidly evolving situations.
• Strong project management and team leadership capabilities.
• Strong relationship-building, stakeholder management, and facilitation skills.

To qualify for the role you must have

• Approximately 5 to 8 years of relevant experience in cyber incident response, digital forensics, cyber investigations, cybersecurity, technology risk, information security, or related disciplines.
• Experience managing cyber incident response engagements involving ransomware attacks, data breaches, unauthorized access incidents, insider threats, or other cybersecurity events.
• Experience overseeing or coordinating digital forensic investigations, including evidence preservation, forensic imaging, log analysis, root cause investigations, and assessment of potential data compromise.
• Experience preparing executive briefings, investigation reports, incident updates, and stakeholder communications relating to cyber incidents.
• Experience working with senior client stakeholders across Information Security, Technology, Risk, Legal, Compliance, Privacy, or other business functions.
• Working knowledge of cyber security and cyber incident response frameworks and standards such as ISO 27001 (Information Security Management Systems), ISO / IEC 27035 (Information Security Incident Management) or similar, but not mandatory.
• Professional certifications such as Security+, GCIH, GCFA, CHFI, EnCE, CISM, CISSP or equivalent are advantageous.

What we offer you

At EY, we’ll develop you with future-focused skills and equip you with world‑class experiences. We’ll empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams.

Are you ready to shape your future with confidence?

To help create an equitable and inclusive experience during the recruitment process, please inform us as soon as possible about any disability-related adjustments or accommodations you may need.

EY | Building a better working world

EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.

Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.

EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.