Consulting - Cyber, Data & Tech Risk Consulting Associate - HK CSI

Location: Hong Kong Line of Service: Consulting Type of employment: Full-time About Our Business Here in Consulting, we work with our clients as trusted allies to navigate challenges, spot opportunities, and help them achieve measurable, sustained outcomes. Combining human ingenuity and deep industry expertise with AI-powered solutions and a seamless approach, we help our clients define, implement, and operate their future. We focus on four pillars: Business Model Reinvention, AI, Data and Tech, Trust and Substantify—to help our clients move at speed and scale with confidence. Within these pillars, our comprehensive solutions cover everything from strategic planning to implementation across key areas such as enterprise strategy, technology, cloud transformation, front office transformation, workforce optimization, risk and regulatory, sustainability, and actuarial services. By joining us, you’ll work with experienced consultants who are passionate about solving business challenges, developing core skills, and creating impact to shape the future. About Our Practice We help our clients devise strategic plans and provide in-depth consulting services across key areas such as cyber, data and technology risk. This supports the effective implementation of strategy and helps clients address business challenges to achieve high-quality, sustainable growth. The growing scale and sophistication of cyber threats have made an effective cybersecurity programme a critical business

. We help organisations protect against threats, enable transformation, and pursue growth. We do not just protect business value — we create it, using cybersecurity and privacy as tools to transform businesses. As companies pivot towards digital business models, exponentially more data is generated and shared among organisations, partners, and customers. At the same time, business digitisation exposes companies to new digital vulnerabilities, making effective cybersecurity and privacy more important than ever. We bring together four key elements to help our clients take a broader view of cybersecurity and privacy as both protectors and enablers of the business: Cybersecurity strategy, transformation and compliance Data privacy and protection Implementation and operations of cybersecurity solutions Incident response and threat management By embracing the transformative power of technology and data in pursuit of opportunity and value creation, our integrated solutions enable clients to build advanced, predictive risk management capabilities — from risk vision and strategy through to the people and processes required across the organisation. At the core of our integrated approach is the use of actionable intelligence to drive alignment and accountability across diverse organisational functions. We support clients in developing end-to-end governance and risk platforms that empower dynamic users, enable the creation of new risk detection metrics through big data and GenAI modelling, strengthen the correlation between KPIs and KRIs, and reinforce the integration of the three lines of defence to uphold robust governance and oversight. By joining us, you will work with experienced consultants who are passionate about solving business challenges, developing core skills, and creating meaningful impact to help shape the future. As an Associate, you will work in multidisciplinary engagement teams to support the delivery of complex solutions for our clients. Our client base includes multinationals, public sector organisations, and state-owned and private enterprises. You will work on engagements aligned with your educational background, experience, interests, and our clients’ needs. You may also collaborate with several teams to support the delivery of these engagements locally and regionally. Working in Dark Lab As part of our Cyber, Data & Tech Risk Consulting team, you will have the opportunity to work in Dark Lab — PwC Hong Kong’s cyber threat operations centre and home to more than 150 Hong Kong-based specialists who replicate real-world hacking scenarios to help organisations build resilience against advanced cyber threats. The team is ISO- and CREST-accredited, with professionals holding certifications from CREST, Offensive Security, GIAC, ISC2, ISACA, AWS and Microsoft. Depending on your interests, you could develop your career across one or more of the following competencies: Cybersecurity Consultancy — design, build and advise: Offensive Security / Red Teaming — Hong Kong and Macau's largest ethical hacking team, running intelligence-led cyber-attack simulations that replicate real threat-actor tactics (mapped to MITRE ATT&CK) to uncover the blind spots that audits and reviews miss. Purple Teaming — collaborative “find and fix” exercises with clients' blue teams to validate and close detection and prevention gaps and increase the cost of attack. AI Security & Cloud Security — designing and reviewing AI-powered security operations (open-source LLMs, RAG architectures, SIEM/EDR integrations) and cloud-native security so that AI-driven threat hunting and alert triage are secure, explainable and effective. DevSecOps — embedding automated security testing (SAST, SCA, DAST/IAST, container and secrets scanning) and quality gates directly into clients' CI/CD pipelines. Independent Assessment & Maturity Uplift — regulation-aligned assessments and maturity uplift against industry recognized frameworks such as HKMA C-RAF, IA GL20, SFC cybersecurity guidelines, ISO 27001/27002, NIST CSF, SWIFT CSP, DPO G3 / S17 and the Protection of Critical Infrastructures (Computer Systems) Ordinance. Digital Trust, Risk Advisory & Regulatory Readiness — advising clients on risk management and control design and implementation to support the trusted launch of new digital services, the adoption of emerging technologies, and readiness for new financial services licences (for example, digital asset-related activities), helping them balance innovation, security, resilience and regulatory expectations. Managed Security Services — engineer and operate: 24x7 Security Operations Centre (SOC) — round-the-clock monitoring, detection engineering and response, with custom detection logic across 200+ log sources and intelligence-driven defence. Digital Forensics & Incident Response (DFIR) and Threat Hunting — one of Hong Kong's most experienced incident-response teams, handling ransomware, business email compromise, APT and long-dwell intrusions, plus proactive threat hunting across endpoint, cloud, identity and network telemetry. Threat Intelligence (TI) — powered by our Research Lab: original research, CVE discovery and exploit development, tracking 230+ threat actors across Hong Kong, Mainland China and global markets to deliver strategic, operational and tactical intelligence. Threat & Vulnerability Management (TVM) — continuous, threat-informed identification, prioritisation and remediation of vulnerabilities across on-premise, cloud and hybrid environments. Pre-emptive Exposure Management (MSSP) & Dark Web Monitoring — continuous attack-surface and dark-web monitoring to surface exploitable exposures, leaked data and brand impersonation before attackers can act on them. Requirements We are looking for motivated and enthusiastic graduates from any discipline who are eager to learn and grow with us. We welcome candidates from diverse backgrounds and do not expect you to have all the answers — what matters most is your leadership, business acumen, attitude, curiosity, and willingness to develop. We are looking for candidates who demonstrate: Experience and enthusiasm relevant to our client services; Business acumen and appreciation of the use of IT systems, technology infrastructure and cloud computing; Strong analytical skills; Strong communication and interpersonal skills; Good organisation skills with influencing skills / leadership potential; Energy and drive; Flexibility to travel to out-of-town assignments; Ability to work under pressure and be flexible to work longer hours if needed; A strong command of English, Cantonese and/or Putonghua. If you are keen to build your career in cyber and Dark Lab, we would especially like to see: AI fluency — you are comfortable using and reasoning about AI tools, and curious about how AI is reshaping both cyber attack and defence; Commercial and regulatory awareness — you demonstrate strong awareness of global trends and regulatory developments, coupled with sound business judgement and a keen eye for emerging risks and opportunities, and can recognise how these evolving forces are shaping the digital landscape. An open mindset and a strong problem-solving orientation, with the resilience to take on unfamiliar and ambiguous challenges; Strong communication skills, with the ability to explain technical findings clearly to both technical and business audiences; A solid foundation and genuine interest in cyber security — hands-on skills, certifications or project experience (for example CTFs, penetration testing or home labs) are a plus, though not essential. We offer comprehensive business and technical training, professional examination training support as well as an excellent environment for career development. If you wish to apply for this position, please access our online application system to submit your application. We are looking forward to seeing you in PwC！