Cybersecurity Consultant/Cybersecurity Risk & Assurance Specialist (over $45K)

Job Responsibilities

• Conduct cybersecurity risk assessments and control reviews to identify, evaluate, monitor, and mitigate risks across IT infrastructure, applications, and network environments.

• Perform red team and purple team exercises, vulnerability assessments, and penetration testing to identify security weaknesses and evaluate the effectiveness of existing security controls.

• Develop and implement remediation plans based on assessment findings to enhance the organization's overall security posture.

• Support the establishment and maintenance of information security policies, procedures, standards, and control frameworks.

• Review and evaluate IT control processes to ensure controls are appropriately designed, implemented, and operating effectively.

• Coordinate and support internal audits, external security reviews, and compliance assessments, ensuring identified risks are addressed in a timely manner.

• Strengthen security monitoring, threat detection, incident response, and mitigation capabilities against current and emerging cyber threats.

• Collaborate with internal stakeholders, clients, and external parties on cybersecurity risk management, governance, and security improvement initiatives.

• Participate in Hong Kong Government Security Risk Assessment and Audit (SRAA) engagements, including security risk assessments, vulnerability assessments, and penetration testing activities.
  

Requirements

• Bachelor's degree or above in Cybersecurity, Computer Science, Information Technology, Software Engineering, or a related discipline.

• Minimum 5 years of hands-on experience in cybersecurity, including penetration testing, red/purple team operations, and DevSecOps practices.

• At least 1 year of practical experience delivering Hong Kong Government SRAA engagements, including Security Risk Assessment, Vulnerability Assessment, and Penetration Testing, in accordance with the HKSAR Baseline IT Security Policy and G3 Practice Guide.

• Strong hands-on experience conducting manual penetration testing on web applications, APIs, mobile applications, and related technology platforms.

• Solid understanding of information security principles, application security, IT risk management, business continuity, project management, and industry best practices.

• Familiarity with cybersecurity frameworks and standards such as ISO 27001, NIST Cybersecurity Framework, CIS Controls, and OWASP.

• Excellent analytical, problem-solving, communication, and stakeholder management skills.

• Ability to work independently and manage multiple projects in a fast-paced environment.

• Professional certifications such as CISSP, CISA, CISM, AAIA, CISP, OSCP, GPEN, CEH, CRTP, or CRT would be an advantage.

• Good command of written and spoken English and Chinese is preferred.

If interested for the above position, please send detailed resume with current and expected salary as well as date of availability through Apply now.

For more job opportunity, please visit our website: www.clts.com 

The personal information collected is strictly for recruitment purpose only