Senior Manager - Cybersecurity and Tech Risk - CDTR - Hong Kong

is commercial. We want someone who can sit in front of a CISO or a CFO and sell the solution, not only deliver it — and who can move between those two registers, designing a detection pipeline in the morning and defending its commercial case in the afternoon. If you have built your career on one of those and want to build the other, we will invest in you.

DarkLab practice areas

You should expect to lead work drawing on any of these, and to be genuinely strong in one or two. Whether your strength is technical or advisory matters far less than that it is real.

Managed Cyber Defence

• Cyber-as-a-Service: 24/7 monitoring, managed detection and response, detection engineering, SOC operations, and our AI-powered SOC

Exposure & Attack Surface Management

• Continuous exposure validation, external attack surface discovery, vulnerability management, watchTowr-based services

Offensive Security

• Penetration testing, red and purple teaming, adversary simulation, SDLC security, CREST-accredited and intelligence-led testing

Threat Intelligence

• Digital footprint reporting, dark web monitoring, threat research, bespoke intelligence assessments, vulnerability research

Digital Forensics & Incident Response

• Incident readiness, investigation, containment and remediation, threat hunting, post-incident review

Cyber Strategy, Governance & Regulatory

• Strategy and maturity assessment, NIST and ISO 27001 frameworks, HKMA C-RAF and iCAST, SFC

• , third-party risk

Privacy & Data Protection

• PDPO, GDPR and PIPL compliance, privacy impact assessment, China Cybersecurity Law, MLPS certification, cross-border data transfer

Cloud & DevSecOps

• Cloud security strategy and architecture, CSPM/CNAPP, secure landing zones, container security, secure development pipelines

Emerging Technology Security

• AI security and AI governance, blockchain and digital asset security, wallet and key management, security engineering and internal products

Key responsibilities

Leading delivery across the practice

• Lead cyber security engagements that draw on more than one DarkLab speciality — assembling the right specialists, holding the parts together, and owning the outcome end to end.
• Scope, price and plan work across the full portfolio, including areas where you are not personally the practitioner. You are expected to know what good looks like, who to put on it, and when something is off.
• Quality-review deliverables across specialities, and act as a senior escalation point on major incidents and difficult engagements.
• Convey pragmatic solutions to complex business problems through written reports and presentations to boards, audit committees and regulators.
• Maintain and raise the quality bar — methodology, deliverable standards, peer review, and risk and quality management on every engagement.

Depth in your own specialities

• Set the technical direction in the one or two practice areas where you are the specialist — owning methodology, tooling decisions and the standard of the work.
• Act as the final technical reviewer in those areas, and as the firm’s subject matter expert in front of clients and regulators.
• Develop the capability behind you: build the bench, run technical training, and grow the next specialists in your domain.
• Stay current in your field and bring what is useful back into the practice — research, tooling, tradecraft, new regulatory expectations.

Managed services and AI

• Own the technical design of managed security service solutions: detection engineering, use case development, SIEM/SOAR architecture, client onboarding and transition, service levels and run-state operating models.
• Bring AI into the detection and response lifecycle — automated triage and enrichment, agentic workflows for tier-1 and tier-2 analysis, LLM-assisted detection engineering and threat hunting — with measurable outcomes in mean time to triage, alert fatigue and detection coverage.
• Advise clients on securing their own AI adoption, covering model and data risk, prompt injection, data leakage and AI governance.

Solutioning and business development

• Act as solution lead for DarkLab's AI-powered SOC and AI security offerings, taking them to market with our client-facing teams in Hong Kong and the region.
• Run the pre-sales cycle: qualify the opportunity, scope it, shape the commercial and technical business case, and build the solution.
• Prepare proposals, presentations and statements of work, and lead technical responses to RFIs, RFPs and tenders.
• Work with commercial constructs that suit managed services — tiered, consumption-based and multi-year models — and understand the margin behind them.
• Present to audiences from CISO and CIO through to CEO, CFO and the board, and run workshops, proofs of concept and executive briefings that convert interest into signed work.
• Build and sustain your own network of client relationships and industry contacts, and act as a trusted adviser across both the pre-sales and post-sales lifecycle.
• Own the handover from sale to delivery, so that what we sold is what the client receives.
• Contribute to offering development — service design, reference architectures, pricing constructs and enablement material — and to our alliances with security and cloud vendors.
• Represent DarkLab externally through thought leadership, research publication, conference speaking and industry bodies.

People and practice

• Supervise, coach, develop and lead multi-disciplinary teams of consultants and SOC analysts, including performance management and career development.
• Build the capability bench — recruitment, technical training, certification pathways and knowledge management.
• Contribute to the commercial management of the practice: resourcing, engagement economics, utilisation and delivery profitability.

Requirements

Essential

• University degree majoring in computer science, information systems, engineering, information security or a related discipline.
• Professional qualifications: CISSP, CISM, CISA, CRISC, OSCP, CREST, GIAC or other security-related qualifications.
• Minimum of 6 years of cyber security experience with a reputable professional / consulting firm, managed security service provider, system integrator, security vendor or multi-national corporation, including at least 2 years leading engagements or service delivery. Candidates with more experience will be considered for the Senior Manager or Associate Director position.
• Depth. Genuine strength in one or two of the DarkLab practice areas listed above — deep enough that you set the direction, own the methodology, and are the person who signs off the work in that area. Depth in an advisory domain counts as much as depth in a technical one: cyber strategy, governance and regulatory, or privacy and data protection, sit on the same footing here as offensive security or detection engineering.
• Breadth. Working command of most of the remainder — enough to scope it, price it, quality-review it, lead a specialist team delivering it, and hold a credible conversation with a client across the whole portfolio. You are not expected to be the technical expert in every area. You are expected to know what good looks like, who to put on it, and when something is off.
• A demonstrable commercial track record: shaping and winning work, contributing to proposals and bids, or carrying a solution or revenue target.
• Working knowledge of the Hong Kong regulatory environment, including HKMA C-RAF and iCAST, SFC requirements and the PDPO; and where relevant Mainland China’s Cybersecurity Law, MLPS and PIPL.
• Excellent communication skills in both oral and written English and Chinese. Cantonese is required for Hong Kong client delivery; Mandarin is a strong advantage for regional work.
• Proven experience as a team leader and coach.
• Ability to interact with executive levels of client and firm management.
• Flexibility to travel to out-of-town engagements within Greater China and South East Asia.
• Preferred background (any of the following)
• Practical experience building, running or selling a managed detection and response or SOC service — not just consuming one.
• Genuine fluency in applying AI to security operations: agentic workflows, LLM-assisted analysis, automation of triage and response, and an honest view of where it works and where it does not.
• Experience securing enterprise AI adoption, or in AI red teaming.
• A track record of taking a new service offering to market — building it, pricing it, positioning it and selling the first deals.
• Vendor experience across the platforms we work with, including watchTowr, Microsoft Security, Palo Alto Networks and AWS.
• Published research, CVE credits, conference speaking or an active presence in the security community.
• Experience operating across Hong Kong, Mainland China and South East Asia.

Personal attributes

• Commercially minded without being a salesperson — you want the work to grow, and you understand that a service has to make money to keep existing.
• Comfortable being the most technical person in a commercial meeting and the most commercial person in a technical one.
• Knows the limits of your own expertise and trusts specialists to be better than you in their domain — while still being able to judge whether their work is good.
• Able to join the dots for a client who needs several of our specialities at once, and to translate between the specialists delivering them.
• Curious across the whole practice, not only your own corner of it. You should want to understand how the other specialities work, even where you will never perform them.
• Flexible, self-starter possessing intellectual curiosity — you follow where the field is going and apply what is useful.
• Pragmatic about when to move fast and when to be rigorous.
• Clear communicator: can explain a technical decision to a non-technical stakeholder without losing precision.

What you will work on

• Our AI-powered SOC — taking it from capability to a service clients buy, renew and reference.
• Managed detection and response, exposure management and attack surface management engagements for enterprise clients across the region.
• Intelligence-led red team and C-RAF / iCAST work for financial services clients.
• New service offerings: designing them, pricing them, and selling the first deals.
• A practice that is building its own products rather than reselling someone else’s.