IT and Cybersecurity Advisory – Associate / Senior Associate

Oct 14, 2026 Oct 15, 2026 3 views

Top Match Talent Solutions IT and Cybersecurity Advisory – Associate / Senior Associate

Key Responsibilities

Perform cybersecurity, privacy, and technology risk assessments aligned with international frameworks and standards (e.g., ISO/IEC 27001, ISO 22301, SOC 2, SRAA, PIA).
Assist clients in designing, implementing, and maintaining Information Security Management Systems (ISMS).
Advise clients on regional regulatory compliance obligations (e.g., HKMA/SFC guidance, PDPO, Protection of Critical Infrastructures Ordinance) and develop clear remediation roadmaps.

Conduct Vulnerability Assessments and Penetration Testing (VAPT) across web, mobile, network, cloud, and enterprise environments.
Execute threat simulations, including Red/Blue/Purple teaming exercises, social engineering, email phishing assessments, and source code reviews.
Evaluate cloud and on-premise IT architectures and security configurations (e.g., Active Directory, PAM/IAM, WAF, Endpoint Protection).

Support clients in threat monitoring, incident response triage, containment, and post-incident reviews.
Respond to client security due diligence inquiries, vendor risk assessments, and regulatory audits.

Prepare executive-ready client deliverables, including risk control matrices, technical VAPT reports, security policies, and management presentations.
Leverage AI tools and automation to streamline security monitoring, risk assessments, and advisory delivery.
Research emerging cyber threats, regulations, and technologies (e.g., AI automation, Web3, Blockchain).

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, Information Systems, or a related STEM discipline.
1–3 years of experience in cybersecurity, security operations, IT audit, or technical risk advisory.

Strong analytical, problem-solving, and communication skills; ability to explain technical risks to non-technical stakeholders.
Excellent command of written and spoken English; proficiency in Cantonese and/or Mandarin is preferred.
Collaborative mindset with strong curiosity about emerging technologies.

Holds one or more recognized professional certifications:
- GRC / Management: CISSP, CISM, CISA, CRISC, CIPP, or ISO 27001 Lead Auditor/Implementer.
- Technical / Offensive Security: OSCP, CREST, GPEN, GWAPT, OSCE, or equivalent.