Senior Penetration Testing & Vulnerability Lead

Global Sports Jobs Limited; Hong Kong; On-site; HKD 900,000 - 1,300,000; Full time

Benefits offered by this job

Competitive benefits package

Dynamic working environment

Development opportunities

Job summary

The Hong Kong Jockey Club IT Division, within Cyber Security, is seeking an experienced Senior Penetration Tester to lead end-to-end engagements and mentor teams across HK and Shenzhen. You will perform tests on applications, infrastructure, and cloud platforms, deliver actionable remediation guidance, and help strengthen security posture.

The role requires 10+ years in penetration testing and certifications such as OSCP/OSCE/CEH, hands-on tooling, and strong communication with stakeholders.

Qualifications

• 10+ years in penetration testing and vulnerability management across multiple domains.
• Certification in one or more of OSCP/OSCE/OSWE/GPEN/CEH/CISSP/CISA or equivalent.
• Hands-on experience with standard securit y tooling and workflows.

Responsibilities

• Lead end-to-end penetration testing engagements across apps and infrastructure.
• Act as SME, supporting requests and project requirements.
• Perform and coordinate tests including web/mobile apps, infrastructure, and cloud security.
• Identify, validate and exploit vulnerabilities, developing effective remediation guidance.
• Develop scripts and tooling to test resilience and strengthen controls.
• Deliver detailed reports and communicate remediation priorities to stakeholders.

Skills

OSCP

OSCE

OSWE

GPEN

CEH

CISSP

CISA

Penetration testing

Vulnerability management

Reverse shells / C2

Education

University degree in CS/IT/cybersecurity

Tools

Kali Linux

Burp Suite

Qualys

Nessus

Nmap

Metasploit

Wireshark

Job description

The Hong Kong Jockey Club IT Division, within Cyber Security, is seeking an experienced Senior Penetration Tester to lead end-to-end engagements and mentor teams across HK and Shenzhen. You will perform tests on applications, infrastructure, and cloud platforms, deliver actionable remediation guidance, and help strengthen security posture.

The role requires 10+ years in penetration testing and certifications such as OSCP/OSCE/CEH, hands-on tooling, and strong communication with stakeholders.