Senior Security Consultant

Ambition; Hong Kong; On-site; HKD 900,000 - 1,300,000; Full time

Job summary

Ambition in Hong Kong seeks a hands-on Senior Cybersecurity Consultant to lead Red Team and risk assessment engagements across infrastructure, cloud and networks, identifying vulnerabilities and recommending practical mitigations. You will partner with stakeholders to drive effective remediation.

Ideal candidates have 5+ years in Red/Purple Team, penetration testing, and DevSecOps, plus experience with SRAA/HKSAR guidelines, governance, and secure software practices.

Qualifications

• Bachelor's or Master's degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, or a related discipline.
• Minimum 5 years of hands-on cybersecurity experience with a strong focus on Red Team operations, Purple Team exercises, penetration testing, and DevSecOps practices.
• Proven experience delivering Hong Kong Security Risk Assessment and Audit (SRAA) engagements, including SRA, VA, and PT, aligned with HKSAR Baseline IT Security Policy and G3 Security Guidelines.
• Demonstrable expertise in manual penetration testing of web applications, APIs, mobile platforms, and modern application architectures.
• Solid understanding of information security governance, business continuity management, secure software development, project delivery methodologies, and industry security frameworks.
• Relevant industry certifications (CISSP, CISA, CISM, OSCP, GPEN, CEH, etc.) highly desirable.
• Strong analytical abilities, stakeholder management skills, and the capability to communicate complex security risks to technical and non-technical audiences.

Responsibilities

• Lead end-to-end cybersecurity risk assessments across infrastructure, applications, cloud, and networks.
• Execute Red Team and Purple Team engagements to emulate threats and validate defenses.
• Drive remediation initiatives by partnering with technical stakeholders.
• Advise on development and governance of cybersecurity policies, standards, and procedures.
• Assess design and operational effectiveness of IT security controls for compliance.
• Coordinate internal and external audits, security reviews, and risk treatment activities.
• Strengthen cyber defense through evaluation of threats, techniques, detection, and response.
• Act as trusted advisor to business and technology stakeholders, promoting security awareness.

Skills

Red Team

Purple Team

Penetration Testing

DevSecOps

Governance & Compliance

Communication

Education

Bachelor's or Master's degree in Cybersecurity/CS/IT/related

Job description

• Lead end-to-end cybersecurity risk assessments across infrastructure, applications, cloud environments, and network ecosystems, identifying vulnerabilities and recommending practical risk mitigation strategies.
• Execute advanced Red Team and Purple Team engagements to emulate real-world cyber threats, validate defensive capabilities, and uncover security weaknesses.
• Drive remediation initiatives by partnering with technical stakeholders to address identified vulnerabilities and improve overall security resilience.
• Advise security and technology teams on the development, implementation, and continuous improvement of cybersecurity policies, standards, procedures, and governance frameworks.
• Assess the design and operational effectiveness of IT security controls, ensuring compliance with organizational and regulatory requirements.
• Coordinate and facilitate internal and external audits, security reviews, and compliance assessments while supporting risk treatment and remediation efforts.
• Strengthen organizational cyber defense capabilities through continuous evaluation of emerging threats, attack techniques, detection mechanisms, and response strategies.
• Act as a trusted advisor to business and technology stakeholders, fostering collaboration and driving security awareness across the organization.

Qualifications & Experience

• Bachelor's or Master's degree in Cybersecurity, Computer Science, Software Engineering, Information Technology, or a related discipline.
• Minimum 5 years of hands-on cybersecurity experience with a strong focus on Red Team operations, Purple Team exercises, penetration testing, and DevSecOps practices.
• Proven experience delivering Hong Kong Security Risk Assessment and Audit (SRAA) engagements, including Security Risk Assessments (SRA), Vulnerability Assessments (VA), and Penetration Testing (PT), aligned with HKSAR Baseline IT Security Policy and G3 Security Guidelines.
• Demonstrable expertise in manual penetration testing of web applications, APIs, mobile platforms, and modern application architectures.
• Solid understanding of information security governance, business continuity management, secure software development, project delivery methodologies, and industry security frameworks.
• Relevant industry certifications are highly desirable, including CISSP, CISA, CISM, OSCP, GPEN, CEH, CRTP, CRT, AAIA, CISP, or equivalent credentials.
• Strong analytical abilities, stakeholder management skills, and the capability to communicate complex security risks to both technical and non-technical audiences.

What Makes an Ideal Candidate

• Hands-on ethical hacker with a strong consulting mindset.
• Comfortable balancing offensive security testing with governance, risk, and compliance requirements.
• Experienced in translating technical findings into actionable business recommendations.
• Able to operate independently while coordinating with cross-functional teams and senior stakeholders.
• Passionate about staying ahead of the evolving cyber threat landscape and emerging security technologies.

Unlock job insights

Hirer responsiveness Salary match Number of applicants