FS Consulting - Technology Risk - Penetration Testing & Purple Team - Sr Consultant/Consultant - Hong Kong

EY; Hong Kong; On-site; HKD 600,000 - 1,000,000; Full time

Job summary

EY is seeking a Senior Consultant in Hong Kong to join the Technology Risk and Cyber Team. You will perform technology compliance reviews, conduct penetration testing and offensive security assessments, and simulate cyber-attacks to guide clients in strengthening defenses.

The role involves evaluating IT architectures, responding to incidents, and ensuring regulatory compliance across financial services sectors.

Qualifications

• Bachelor’s or Master’s degree in Information Security, Information Systems, Computer Science, Engineering or related fields.
• 1–4 years of relevant experience in penetration testing, offensive security assessments, or Purple Team engagements.

Responsibilities

• Conduct Technology Compliance Reviews across banking, wealth and asset management, and insurance sectors in Hong Kong and beyond.
• IT Risk Assurance through independent audits of financial systems for integrity and compliance.
• Risk Analysis & Controls Evaluation including cloud security per regulatory requirements.
• Vulnerability Assessment & Penetration Testing to uncover security risks.
• Cyber-Attack Simulation to identify vulnerabilities and recommend improvements.
• IT System Architecture Review of architectures and configurations.
• Incident Response to manage security incidents and help clients recover.

Skills

Penetration testing

Offensive security

Purple Team engagements

Security frameworks

Cloud security

Incident response

Threat hunting

Malware analysis

EDR / SIEM / SOAR

Python / SQL

Education

Bachelor’s or Master’s in Information Security / Information Systems / Computer Science / Engineering

Tools

Burp Suite

Nmap

Metasploit

Nessus

Cobalt Strike

BloodHound

PowerShell

Job description

At EY, we’re all in to shape your future with confidence.

We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go.

Join EY and help to build a better working world.

The Opportunity

Technology compliance, licensing, governance setup, massive data storage and related privacy security, virtual asset management, and resilience of the business require rigorous technology risk measures to safeguard the crown jewels and comply with regulatory requirements. support businesses to identify and manage risks while enhancing their agility.

Join EY’s Technology Risk and Cyber Team and become a key player in defending against cyber threats. As a Senior Consultant, you will work with top-tier talent in a collaborative environment, tackling complex cybersecurity challenges and simulating real-world cyber-attacks. At EY, you will also guide clients to manage technology risks, comply with regulatory requirements, and strengthen their cybersecurity posture. You will apply your technical skills to help businesses identify and manage risks while enhancing their agility.

Your key responsibilities

Under the leadership of the project manager, you will:

• Conduct Technology Compliance Reviews: Assess institutions in banking, wealth and asset management, and insurance across Hong Kong, the Greater Bay Area, and other regions.
• IT Risk Assurance: Deliver quality, independent audits of financial systems to ensure integrity and compliance.
• Risk Analysis & Controls Evaluation: Analyze IT environments, identify risks, and evaluate controls (including cloud security) according to regulatory requirements and industry best practices.
• Vulnerability Assessment & Penetration Testing: Perform in-depth vulnerability scans and penetration tests to uncover security risks.
• Cyber-Attack Simulation: Simulate real-world attacks to identify vulnerabilities and recommend cybersecurity improvements.
• IT System Architecture Review: Evaluate IT system architectures and configurations.
• Incident Response: Respond promptly to security incidents and support clients in managing and recovering from breaches.

What we look for

• A Bachelor’s degree or Master’s degree preferably in one of the following areas: Information Security, Information Systems, Computer Science, Engineering, and other related majors.
• 1-4 years of relevant experience in penetration testing, offensive security assessments, or Purple Team engagements (consulting experience preferred).
• Industry-recognized certifications such as OSCP, OSWE, OSEP, OSEE, GPEN, CRTO, GXPN, CRTP, CRTE, or equivalent. Candidates who are actively pursuing these certifications are also encouraged to apply.
• Strong knowledge of security frameworks, protocols, and attack vectors (e.g., OWASP, MITRE ATT&CK, NIST, ISO).
• Experience with vulnerability assessment and penetration testing tools (e.g., Burp Suite, Nmap, Metasploit, Nessus, Cobalt Strike, BloodHound, PowerShell).
• Understanding of TCP/IP, DNS, VPNs, firewalls, and network protocols.
• Strong knowledge of cloud security, secure development practices, and crafting/red teaming offensive infrastructure.
• Familiarity with Windows and Linux environments, including Active Directory attacks, lateral movement, and persistence techniques.
• Experience in incident response, threat hunting, and malware analysis.
• Familiarity with security event analysis, incident response, and computer forensics tools.
• Experience in bypassing modern defensive controls (e.g., EDRs, network defenses, email filters).
• Experience in performing digital forensics and incident response analysis (e.g., network, application/log analysis, disk forensics, memory forensics, malware analysis, cloud forensics, endpoint forensics). Expert knowledge of common security tools (including EDR, DLP, UEBA, SIEM, SOAR, and other related forensics platforms) is a plus.
• Knowledge of SQL, Python or other programming languages would be considered as an advantage
• Candidates with less experience may be considered for the Consultant role

What we offer you

At EY, we’ll develop you with future-focused skills and equip you with world-class experiences. We’ll empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams. Learn more.

To help create an equitable and inclusive experience during the recruitment process, please inform us as soon as possible about any disability‑related adjustments or accommodations you may need.

EY | Building a better working world

EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.

Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.

EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi‑disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.