Senior Cyber Incident Responder & Forensics Lead

EY; Hong Kong; On-site; HKD 480,000 - 760,000; Full time

Job summary

EY Hong Kong is seeking a Senior in Forensic & Integrity Services, Cyber Incident Response, to join our team. You will lead cognitive investigations, coordinate incident response activities, and work with Legal, Risk, Privacy, and IT teams to assess, contain, and recover from cyber events.

You will develop client deliverables, engage in post-incident reviews, and help strengthen cyber security capabilities across diverse engagements.

Qualifications

• 2–5 years of relevant experience in cyber incident response, digital forensics, cyber investigations, cybersecurity, technology risk, information security, or related disciplines.
• Experience supporting cyber incident response engagements involving ransomware attacks, data breaches, unauthorized access incidents, insider threats, or other cybersecurity events.
• Experience supporting digital forensic investigations, including evidence preservation, forensic imaging, log analysis, root cause investigations, and assessment of potential data compromise.
• Experience preparing investigation reports, incident updates, presentations, and stakeholder communications relating to cyber incidents.
• Experience working with stakeholders across Information Security, Technology, Risk, Legal, Compliance, Privacy, or other business functions.
• Working knowledge of cyber security frameworks and standards such as ISO 27001 or ISO/IEC 27035 (not mandatory).
• Professional certifications such as Security+, GCIH, GCFA, CHFI, EnCE, CISM, CISSP, or equivalent would be advantageous.

Responsibilities

• Support cyber incident response engagements involving cyber breaches, ransomware attacks, data exfiltration, insider threats, unauthorized system access, and other cybersecurity events.
• Support engagement teams during live cyber incidents by assisting with situation assessment, issue tracking, stakeholder coordination, and response activities.
• Assist with digital forensic investigations, including evidence preservation, forensic imaging, forensic data collection, log analysis, timeline reconstruction, root cause assessment, and analysis of potential data compromise or exfiltration.
• Perform forensic analysis across endpoints, servers, cloud environments, mobile devices, email systems, and other relevant technology platforms to help determine the scope and impact of cyber incidents.
• Assist in assessing the nature and extent of compromised systems, accounts, and data to support containment, eradication, recovery, and remediation activities.
• Conduct cyber incident impact assessments, including analysis of operational, regulatory, financial, and reputational implications.
• Support clients in determining whether sensitive, personal, confidential, or regulated data has been accessed, compromised, or exfiltrated.
• Develop incident reports, executive briefings, action trackers, investigation findings, presentations, and other client deliverables.
• Work closely with client stakeholders including Legal, Risk, Compliance, Communications, Privacy, Human Resources, Information Security, and Technology functions throughout incident response and recovery activities.
• Support post-cyber incident reviews, root cause assessments, and lessons learned activities to identify opportunities for strengthening cyber security and incident response capabilities.
• Manage workstreams and support project delivery to ensure engagements are delivered on time and to a high-quality standard.

Skills

Cyber incident response

Digital forensics

Cyber investigations

Information security

Technology risk

Stakeholder management

Communication skills

Analytical thinking

Problem solving

Job description

EY Hong Kong is seeking a Senior in Forensic & Integrity Services, Cyber Incident Response, to join our team. You will lead cognitive investigations, coordinate incident response activities, and work with Legal, Risk, Privacy, and IT teams to assess, contain, and recover from cyber events.

You will develop client deliverables, engage in post-incident reviews, and help strengthen cyber security capabilities across diverse engagements.