Cybersecurity Specialist (Governance & Technical Security) - ITS

BDO Limited; Hong Kong; On-site; HKD 600,000 - 1,000,000; Full time

Job summary

BDO Limited in Hong Kong seeks a Cybersecurity Specialist (Governance & Technical Security) to strengthen information security controls and support the firm’s ISO/IEC 27001 journey. The role blends governance with practical security work, coordinating remediation and security improvements across endpoints, networks, and cloud services.

You will collaborate with external partners and internal ITS teams, driving implementation and evidence gathering while promoting strong security practices across

Qualifications

• Degree in Information Technology, Computer Science, Cybersecurity or related field.
• At least 5 years of relevant IT/security experience, combining operations with governance.
• Good knowledge of ISO/IEC 27001 and practical experience supporting implementation, certification or audit.

Responsibilities

• Act as a key cybersecurity contact within the ITS team and coordinate day-to-day information security matters.
• Support ISO/IEC 27001 certification programme, including gap assessments and remediation.
• Review controls and identify improvements against ISO 27001 and best practices.
• Coordinate vulnerability assessments, security reviews, penetration testing and remediation.
• Investigate vulnerabilities and assist in applying fixes and mitigating controls.
• Monitor and ensure remediation within timelines.
• Assist in security incidents, including investigation and containment.
• Support configuration and hardening of endpoints, servers, networks, and cloud services.
• Review IAM, MFA and privileged access controls.
• Provide cybersecurity advice to ITS team and support audits and compliance.

Skills

Cybersecurity operations

InfoSec governance

ISO/IEC 27001

Endpoint protection

Vulnerability management

SIEM & monitoring

Access management

MFA & privileged access

Security incident response

English/Chinese communication

Education

Degree in IT/CS/Cybersecurity

Tools

EDR

Firewalls & VPN

Identity & access management

SIEM

Job description

Cybersecurity Specialist (Governance & Technical Security) - ITS

We are looking for an experienced and hands‑on Cybersecurity Specialist to join our Information Technology Services (ITS) team.

The successful candidate will be responsible for coordinating and overseeing cybersecurity matters across the firm, with a particular focus on strengthening our information security controls and supporting the firm's journey towards ISO/IEC 27001 certification.

This is not purely a governance or policy role. We are looking for someone who combines an understanding of information security governance and risk management with strong practical technical capabilities. The candidate should be comfortable identifying security issues, investigating their root causes, recommending solutions and, where appropriate, implementing or coordinating the required technical remediation.

The role will work closely with our external cybersecurity and ISO 27001 security partner, as well as internal ITS teams and key business stakeholders.

What you’ll be doing

Act as a key cybersecurity contact within the ITS team and coordinate day‑to‑day information security matters.

Work closely with our external security partner to support the firm's ISO/IEC 27001 certification programme, including gap assessments, remediation activities, control implementation and supporting evidence.

Review existing security controls and identify areas for improvement against ISO 27001 and recognised cybersecurity practices.

Coordinate vulnerability assessments, security reviews, penetration testing and remediation activities.

Investigate security vulnerabilities and technical security issues and assist in implementing appropriate fixes and mitigating controls.

Monitor and follow up on identified vulnerabilities to ensure remediation is completed within agreed timelines.

Assist in responding to cybersecurity incidents, including investigation, containment, remediation and follow‑up actions.

Support the security configuration and hardening of endpoints, servers, networks, cloud environments and Microsoft 365 services.

Review identity and access management, privileged access, authentication and other security controls.

Support security monitoring, logging, endpoint protection and threat detection activities.

Conduct security risk assessments for new systems, applications and technology changes.

Assist with third‑party/vendor security assessments where required.

Maintain cybersecurity risk, vulnerability, incident and remediation records.

Provide practical cybersecurity advice and technical assistance to other members of the ITS team.

Support internal and external security audits, accreditation exercises and compliance reviews.

Promote cybersecurity awareness and good security practices throughout the firm.

Support and act towards the BDO Global Vision

Be committed to act with the firm’s core values and competency expectations

What you’ll bring

Degree in Information Technology, Computer Science, Cybersecurity, Information Security or a related discipline.

At least 5 years of relevant IT/security experience, preferably combining cybersecurity operations with information security governance.

Good knowledge of ISO/IEC 27001 and practical experience supporting ISO 27001 implementation, certification or audit activities.

Strong hands‑on knowledge of cybersecurity technologies and controls, such as:

Endpoint protection / EDR

Vulnerability management

Firewalls, network security and VPN

Identity and access management

MFA and privileged access

SIEM, security monitoring and logging

Windows endpoint/server security and hardening

Practical experience investigating vulnerabilities and implementing or coordinating technical remediation.

Good understanding of cybersecurity risk assessment, incident response and security control frameworks.

Able to communicate security risks clearly to both technical and non‑technical stakeholders.

Strong analytical, troubleshooting and problem‑solving skills.

Good written and spoken English and Chinese.

Strong team player with good interpersonal and communication skills.

Professional Certifications

Professional certification such as CISSP, CISA, CISM, CCSP or security related certification would be an advantage, but is not essential. Candidates with relevant practical cybersecurity experience are also encouraged to apply.

What We Are Looking For

We are particularly interested in a candidate who is both security‑minded and technically hands‑on.

The ideal person should not only be able to identify risks, recommend security controls and support ISO 27001 compliance, but also be comfortable working with IT infrastructure and security technologies to investigate problems, apply fixes and drive remediation through to completion.

We’re BDO, a global network connected to local markets. Our people work together to provide specialist expertise, helping businesses achieve their goals and grow.

We inspire others, to go further. We create together, to reach higher. We build trust, to lead purposefully.

Whether you’re building your future or starting your career – with us, you won’t do it alone. From creating solutions for our clients to building careers for our people, we shape what matters, and that’s where you come in.

We’re BDO, a global network connected to local markets. Our people work together to provide specialist expertise, helping businesses achieve their goals and grow.

We inspire others, to go further. We create together, to reach higher. We build trust, to lead purposefully.

Whether you’re building your future or starting your career – with us, you won’t do it alone. From creating solutions for our clients to building careers for our people, we shape what matters, and that’s where you come in.