Consulting – Financial Services – Cyber Security – Cloud Security – Senior Consultant – Ernst & Young Advisory Services Limited – Hong Kong
At EY, we’re all in to shape your future with confidence.
We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go.
Join EY and help to build a better working world.
The opportunity
As organizations accelerate cloud adoption and introduce AI-enabled solutions, they need security professionals who can translate business, technology and regulatory requirements into practical and resilient designs. As a Senior Consultant in our Cyber Security team, you will help financial services clients assess, design and improve security across cloud platforms, AI solutions, enterprise architectures and technology configurations.
You will work as part of an internationally connected team, supporting complex security transformation and governance engagements. The role combines hands-on technical analysis with client-facing consulting, giving you the opportunity to shape secure solutions, identify control weaknesses and provide clear, actionable recommendations.
We will support you with career-long learning, coaching and exposure to multidisciplinary teams. You will collaborate with colleagues across cyber security, cloud, data, AI, technology risk and business consulting to help clients build trust and resilience.
Your Key Responsibilities
- Participate in cyber security engagements for financial services clients, with a primary focus on cloud security, AI security, security architecture assessment and configuration review.
- Assess cloud environments and solution designs against security good practices, client requirements and applicable regulatory expectations, covering areas such as identity and access management, network security, data protection, encryption, logging and monitoring, workload protection, resilience and secure operations etc.
- Review cloud and technology configurations across infrastructure, platforms, applications and security services; identify control gaps, validate observations with technical stakeholders and develop risk-based remediation recommendations.
- Assess the security of AI solutions and their supporting environments, including governance, access control, data protection, model and application interfaces, secure development, third-party dependencies, monitoring and misuse or abuse scenarios.
- Develop and review security architectures, principles, standards, patterns and control requirements for cloud, AI, application, infrastructure and hybrid environments.
- Support threat modelling, security design reviews and architecture risk assessments across the solution lifecycle, from requirements and design through implementation and operation.
- Conduct interviews and workshops with business, technology, risk and security stakeholders; translate technical findings into concise business impacts and practical actions.
- Prepare high-quality client deliverables, including assessment reports, architecture documents, configuration review workpapers, risk registers, remediation roadmaps and executive presentations.
- Manage day-to-day engagement activities, monitor progress and quality, escalate risks and issues, and maintain clear communication with senior team members and client stakeholders.
- Coach junior team members, share technical knowledge and contribute to the development of reusable methods, accelerators, proposals and thought leadership.
- Build productive client relationships and identify opportunities where additional cyber security support may create value.
Skills and Attributes for Success
As a Senior Consultant, you will contribute technically to client engagements while taking ownership of defined workstreams and deliverables. You will be expected to apply structured judgement, challenge designs constructively and communicate security issues in language that both technical and business stakeholders can act on.
In line with our commitment to quality, you will confirm that evidence, analysis and conclusions are complete, traceable and ready for review. You will also help create a positive learning culture by supporting and coaching junior colleagues.
To qualify for the role you must have
- A bachelor's degree in computer science, information technology, information systems, cyber security, engineering or a related discipline; equivalent relevant experience will also be considered.
- At least 3 years of relevant experience in cyber security, technology risk, security engineering, architecture or consulting, with sufficient experience to independently deliver defined workstreams.
- Practical experience in at least two of the following areas: cloud security assessment or design; security architecture review; technical configuration review; AI or data security; application, infrastructure or platform security assessment.
- Working knowledge of one or more major cloud platforms, such as Azure, AWS, GCP, AliCloud, and an understanding of shared responsibility, cloud-native security services and common cloud control domains.
- Experience reviewing security settings or technical evidence using cloud consoles, configuration exports, command-line tools, scripts, APIs or security posture management outputs.
- Understanding of security architecture concepts, including identity-centric security, zero trust, network segmentation, encryption and key management, secrets management, logging and monitoring, vulnerability management, secure development and resilience.
- Understanding of AI security risks and controls across the AI solution lifecycle, including data and access risks, prompt and interface abuse, model or service dependencies, output handling, monitoring and governance.
- Familiarity with internationally recognized cyber security frameworks and guidance, such as NIST Cybersecurity Framework, NIST AI Risk Management Framework, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 42001, CIS Benchmarks, CSA Cloud Controls Matrix or equivalent.
- Strong analytical, problem-solving and report-writing skills, with the ability to connect technical observations to risk and business impact.
- Strong interpersonal and communication skills, with the confidence to interact effectively with client management, architects, engineers, developers, risk teams and auditors.
- Good command of spoken and written English and Cantonese. Mandarin is an advantage.
Ideally, you’ll also have
- Consulting experience within financial services or another highly regulated sector.
- Knowledge of cyber security and technology risk expectations issued by Hong Kong financial regulators, and experience applying regulatory requirements in assessments or solution designs.
- Experience with cloud security posture management, infrastructure-as-code review, security testing, DevSecOps, container or Kubernetes security, API security, or security information and event management.
- Experience assessing generative AI applications, AI platforms, machine learning environments or AI-enabled business solutions.
- Relevant professional or technical certifications, such as CCSP, CISSP, CISM, CISA, SABSA, TOGAF, CCSK, cloud security or cloud architect certifications, or equivalent.
- Ability to use scripting or data analysis techniques to improve the efficiency, consistency and coverage of technical reviews.
What we look for
- A practical security professional who is comfortable moving between architecture, configuration evidence, risk analysis and client conversations.
- A structured thinker who can distinguish material risks from minor observations and develop proportionate, implementable recommendations.
- A curious and adaptable team member who keeps pace with evolving cloud and AI technologies without losing sight of core security principles.
- A clear communicator who can explain technical content in business language and produce concise, defensible deliverables.
- A collaborative colleague with a strong sense of ownership, quality and professional integrity, who can work effectively under pressure and meet tight deadlines.
What we offer you
At EY, we’ll develop you with future-focused skills and equip you with world-class experiences. We’ll empower you in a flexible environment, and fuel you and your extraordinary talents in a diverse and inclusive culture of globally connected teams. Learn more.
Are you ready to shape your future with confidence? Apply today.
To help create an equitable and inclusive experience during the recruitment process, please inform us as soon as possible about any disability-related adjustments or accommodations you may need.
EY | Building a better working world
EY is building a better working world by creating new value for clients, people, society and the planet, while building trust in capital markets.
Enabled by data, AI and advanced technology, EY teams help clients shape the future with confidence and develop answers for the most pressing issues of today and tomorrow.
EY teams work across a full spectrum of services in assurance, consulting, tax, strategy and transactions. Fueled by sector insights, a globally connected, multi-disciplinary network and diverse ecosystem partners, EY teams can provide services in more than 150 countries and territories.
