Digitisation has revolutionised businesses in Hong Kong, but it has also unleashed a multitude of new threats: Cyber-threats, sophisticated viruses, industrial espionage and even attacks by state actors are among the challenges that organisations face in the 21st century.

According to the SCMP, online scam cases in Hong Kong rose to 14,160 costing HKD$2.04 Billion, with online investment fraud alone totalling HK$540 Million.

Cyber-security is finding ways to stay one step ahead of the hackers. It’s an elite position that requires creativity, intuition, and an exhaustive knowledge of security protocols.

Organisations are aware of the Pandora’s box that accompanies technological transformation and want to keep their data safe.

However, there just aren’t enough skilled professionals in Hong Kong to staff available roles. This talent shortage means there’s a wealth of opportunities out there for those considering whether to choose a cyber-security as a career.

Related: What is the ongoing impact of COVID-19 on cyber-security?

Learn more about this sector, including the skills and experience you need and the salary you can expect to earn in Hong Kong.

Why choose cyber-security as a career?

Businesses are becoming increasingly more reliant on technology as they adopt new tools and digitise processes to support remote and hybrid teams, drive efficiency and innovation, and better serve their customers anytime, anywhere.

The downside of all this technological change is that organisations are also at greater risk for cyber-attacks and data breaches.

Cyber-security incidents are not only disruptive but also costly. Hong Kong lost more than HKD$2.96 billion from cyber-attacks in 2020, with those numbers expected to rise.

Organisations need cyber-security experts to help protect their data and systems from attack by malicious actors.

Related: How will COVID-19 shape demand for cyber-security skills

What do cyber-security professionals do?

Cyber-security can vary greatly depending on company size, the current staff on the information systems (IS) security team, the state of existing security infrastructure and available resources.

The goal is to keep an organisation safe from all digital threats. This involves several responsibilities, including:

Design and implementation

Cyber-security professionals are tasked with putting the best possible security measures in place by:

  • Devising an overarching security strategy
  • Designing an infrastructure that keeps data safe without slowing down performance
  • Making investment decisions where new software or hardware is required
  • Overseeing the implementation of all security measures
  • Managing iterative improvement projects
  • Building new security infrastructure from scratch (if needed)

Testing

Digital threats are continually evolving, so cyber-security personnel oversee a regular security testing strategy.

That includes conducting penetration testing, analysing traffic, and checking the performance of security systems.

Planning

Security professionals are always thinking about next steps and future requirements. Sometimes, this planning is driven by external factors, such as new cyber-security threats.

Often, the security department works with other teams to help deliver strategic goals, like moving to cloud platforms or building mobile applications.

Threat analysis

These professionals monitor and analyse all attempts to breach security, whether those attempts were successful or not.

hey use this information to improve the approach to security and prevent future attacks.

Cyber-security teams also have to keep abreast of cyber-security news and monitor known threats in the wild.

Compliance

IT security professionals are typically required to work within the confines of complex laws. There are regional regulations — like the European Union’s GDPR legislation — as well as industry-specific regulations, HIPAA, for example, in the medical field. Cyber-security experts must have a precise understanding of these laws and ensure that all security measures are fully compliant.

Related: 8 ways to deal with the cyber-security skills shortage in Hong Kong

Cyber-security job requirements

Cyber-security is a multidisciplinary IT role that requires expert knowledge of hardware, networking, databases, security software (such as anti-virus systems), software architecture and some programming. Most employers will ask for a minimum of five years’ experience working in a professional IT security role.

A bachelor's degree in an IT-related field is essential for these professionals, and a master's degree is highly desirable. The following certifications are also desirable:

  • CISSP (Certified Information Systems Security Professional)
  • CISM (Certified Information Security Manager)
  • CEH (Certified Ethical Hacker)

Soft skills are crucial in this role. Hiring managers will look for candidates who excel in:

  • Communication and collaboration
  • Time management and organisation
  • Adaptability and flexibility
  • Critical thinking and problem solving
  • Leadership

Related: Security Engineer duties and responsibilities of the job

How to start a career in cyber-security

There are simply no shortcuts in cyber-security. You need to work your way up the ladder and prove that you have a track record of outstanding performance in security roles.

If you’re just beginning your IT career, investigate computer technician or network admin positions. Work your way up to a security role, like network security administrator or penetration tester, to gain some experience in the discipline.

You should also investigate relevant certifications, so your resume stands out.

If you have an IT background and want to pivot to security, the best path is to find ways to apply security principles to your current role. For example, if you’re a software developer, try to focus on software security and building resilient applications.

If you’re a mid-career IT professional who’s struggling to find opportunities at the architect level, you might consider moving into security consultancy. This would mean starting your own business and finding clients, but if you’re willing to take those risks, you’ll gain invaluable experience. Combine that expertise with relevant certifications, and you’ll find yourself in an excellent position to land a senior security role.

Related: Security Architect duties and responsibilities of the job

Cyber-security salary in Hong Kong

According to the latest Robert Half Hong Kong Salary Guide, the midpoint salary range for a cyber-security professional is HKD$605,000.

Consulting is another popular career path for skilled cyber-security professionals and working on a contract basis can impact your earnings.

As many employers are currently having difficulties hiring full-time security staff, they’re looking at flexible staffing solutions for cyber-security specialists. If you work as a consultant, your fee will be negotiable depending on your experience, the kind of project you’ll be delivering and the organisation’s IT budget.

Regardless of whether you’re looking for a full-time job or are interested in consulting, choosing cyber-security as a career path is a lucrative one.