Cybersecurity Consultant (Vendor, Up to 60K)

Salary: $40,000 – $60,000 per month

岗位职责 | Key Responsibilities

• 一线实操与项目交付（Hands-on Delivery）： 亲力亲为执行网络安全交付项目，涵盖 Web 应用、API、网络与混合云基础设施的深度渗透测试、VAPT、脆弱性扫描及基线安全配置核查。

• 深度漏洞分析与报告编写： 独立进行实机攻防测试，挖掘深层漏洞与潜在攻击链路，精准评估对客户业务的实际影响，并独立撰写专业、规范、面向客户交付的技术与管理总结报告。

• 客户需求沟通与项目全生命周期对接：

  • 在项目立项阶段，深入与客户不同业务及技术团队沟通，精准把握客户的安全目标、测试边界及特定业务限制（Scoping & Requirement Discovery）。

  • 主导项目启动会、进度汇报、成果汇报（Presentation）及结项复盘，确保双方预期一致。

• 漏洞修复指导与复测闭环： 用通俗且具说服力的语言向客户阐明安全风险，协助客户技术团队理解修复策略，全程跟进整改进度并亲力亲为进行漏洞复测验证。

• 售前支持与技术方案设计： 协助业务拓展与售前阶段，参与客户初步技术交流，协助评估工作量（Effort Estimation），根据客户实际痛点定制贴合需求的服务范围（Scope of Work）。

• 质量管理与交付体验： 严格把控项目交付标准，确保测试证据留存合规、文档详尽严谨、项目按期交付，并持续维护高标准的客户满意度与服务体验。

• Hands-on Project Delivery: Directly perform hands-on cybersecurity service engagements, including deep-dive penetration testing, VAPT, Web and API security assessments, infrastructure assessments, vulnerability scanning, and baseline configuration reviews.

• Technical Analysis & High-Impact Reporting: Independently conduct offensive security testing, uncover complex vulnerability chains and attack paths, evaluate real-world business impacts, and draft professional, client-ready technical and executive summary reports.

• Client Requirement Gathering & Lifecycle Engagement:

  • Actively engage with customer technical and management teams during scoping to thoroughly discover, elicit, and define client-specific security objectives, test boundaries, and operational constraints.

  • Drive direct customer interactions throughout project kickoff, status syncs, technical debriefs, executive presentations, and project sign-off.

• Remediation Advisory & Hands-on Verification: Articulate technical findings and risk exposures clearly to clients, guide their technical personnel through remediation steps, track remediation progress, and perform hands-on verification testing to ensure risk closure.

• Scoping & Pre-sales Collaboration: Partner with sales and account teams on technical discussions, help analyze customer pain points, estimate delivery efforts, and structure customized Scopes of Work (SOW) during pre-sales stages.

• Delivery Excellence & Quality Assurance: Maintain meticulous standards regarding evidence collection, technical documentation, project milestones, and professional service quality to ensure top-tier client experience.
  

任职资格 | Qualifications & Requirements

• 实操经验： 具备 3 年及以上渗透测试、VAPT、红蓝对抗、进攻性安全（Offensive Security）或安全咨询领域的一线亲力亲为（Hands-on）工作经验。

• 技术纵深： 拥有扎实的实操测试能力，熟悉主流攻防工具与手法，对 Web 应用、移动端/API、网络设备、操作系统、内网域控或云原生环境至少两个维度有深入的实战渗透能力。

• 卓越的沟通与客户管理能力：

  • 具备极强的需求理解与沟通协调技巧，善于引导客户明确自身安全诉求，能够针对技术骨干与非技术管理层进行差异化的高效沟通。

  • 具备良好的问题分析与攻坚能力，能在高压力或复杂客户环境下推进项目按时交付。

• 独立交付能力： 能够端到端独立主导项目测试全流程，具备规范的文书撰写习惯，能输出高质量的中/英文专业技术报告。

• 语言要求： 必须具备流利的粤语（Cantonese）听说交流能力；同时具备流利的英语（English）或普通话（Mandarin）商务沟通与报告撰写能力。

• 合法工作身份与背景： 必须持有香港法定工作权利。有服务香港特区政府部门、金融机构（如银行、保险、券商）、公共机构或跨国大型企业经验者优先。

• Hands-on Experience: 3+ years of direct, hands-on experience in penetration testing, VAPT, offensive security, red teaming, or cybersecurity consulting.

• Technical Proficiency: Proven track record in conducting hands-on assessments across diverse platforms, such as Web applications, APIs, network infrastructure, Active Directory, cloud, or container environments.

• Client Communication & Requirement Elicitation:

  • Exceptional verbal and written communication skills with proven ability to elicit, understand, and clarify client business and security requirements.

  • Adept at bridging the gap between technical teams and non-technical management, facilitating consensus, and resolving delivery roadblocks.

• Autonomous Execution: Capable of driving security engagements end-to-end independently, with demonstrated excellence in generating structured, client-facing technical deliverables in both English and Chinese.

• Language Proficiency: Fluent Cantonese is mandatory. Professional working fluency in English or Mandarin is also required.

• Work Authorization & Industry Background: Must hold existing legal authorization to work in Hong Kong. Prior delivery experience serving Hong Kong government bodies, financial institutions (FSI), public sector entities, or large enterprises is highly regarded.