1. 本科及以上学历，网络安全、信息技术审计、计算机科学、信息系统管理、软件工程、人工智能或相关专业；具有相关能力与经验的其他专业候选人亦可考虑。 2. 具有1–3年网络安全、数据安全、个人信息保护、工控安全、信息技术风险管理、人工智能治理或相关领域经验，具备信息技术与安全基础知识；咨询或客户项目经验优先。高级咨询顾问应能够相对独立地完成明确范围内的分析与交付任务。 3. 具备结构化解决问题的能力：能够澄清目标和约束、分解复杂问题、基于证据形成判断，并将分析转化为可执行的建议；面对不完整信息时，能够合理提出假设、验证判断并及时沟通风险。 4. 具备快速学习能力和主动性：愿意进入不熟悉的业务与技术领域，能够有效利用资料、工具、反馈和团队资源，快速掌握关键概念并应用于实际工作。 5. 具备良好的AI素养和开放的工作思维：主动探索AI可带来的改进机会，能够清晰定义问题、提供必要背景、迭代提问并审慎核验输出；理解AI的能力边界、幻觉及数据安全风险，在遵守公司政策和客户要求的前提下，善用AI提高工作质量与效率。能够结合具体案例说明自己的实践和学习收获。 6. 具备良好的中英文书面与口头沟通能力，能够清晰表达分析和建议；具有团队协作、客户服务和交付责任意识，能够根据项目需要提供现场支持。 7. 了解网络安全、数据安全、个人信息保护或工控与OT安全相关框架、标准及要求，并能够结合实际场景理解和应用。 8. 行业方向要求（根据应聘方向，符合以下相应行业要求）： （1）金融行业方向：对金融行业监管部门在网络安全及个人信息保护方面的监管要求具有全面、准确的理解，熟悉相关要求在金融同业日常经营与管理中的实际落地情况；对金融机构业务具有一定了解，并具备良好的英语沟通能力。 （2）汽车行业方向：熟悉汽车产品网络安全、ISO/SAE 21434及Automotive SPICE（ASPICE）；具有整车厂（OEM）、一级供应商（Tier 1）或咨询公司的相关实际内审或外审经验者优先。 （3）医药和生命科学行业方向：熟悉临床研究、生产制造及商业化（Commercial）等核心业务流程，理解各业务环节的数据使用与流转场景及相关数据安全风险，能够结合业务需求识别数据安全问题，并提出和推动落实可行的保护措施；具有相关行业项目或实践经验者优先。 加分经验 在AI安全与治理、网络安全、数据安全、工控安全、云安全、个人信息保护中的一个或多个方向具有项目、研究或实践经验者优先。持有CISSP、CISA、CISM、CIPM、CIPP、CISP、AIGP、AAIA等相关认证者优先。 English Version Service Line Overview Our Technology Risk team helps clients address cybersecurity, data security and privacy challenges, and build effective governance and security capabilities as they adopt AI, cloud and other digital technologies. We are looking for curious individuals with a problem-solving mindset and a commitment to continuous learning. You will help translate complex technology and compliance requirements into practical solutions, while exploring how AI can strengthen security capabilities and improve the quality and efficiency of consulting delivery. Key Responsibilities 1. Contribute to cybersecurity, data security and personal information protection engagements through current-state reviews, gap analyses, risk assessments and assessments of control effectiveness, helping clients develop and implement improvement plans. 2. Help clients establish and enhance security governance, data lifecycle protection and personal information management practices, including data classification, access controls, data loss prevention, third-party risk management, and security and privacy operations. 3. Contribute to industrial control system and operational technology (OT) security engagements by helping review assets and network architectures, assess risks and strengthen security governance. Support IT/OT network segmentation, remote maintenance access controls, third-party access management, and improvements to monitoring and incident response arrangements. Develop recommendations that take production continuity, system reliability and operational safety into account. 4. Contribute to AI security and governance engagements by assessing risks in generative AI and AI agent applications, such as data leakage, prompt injection, misuse of permissions and third-party dependencies, and supporting the development of governance processes, security controls and assessment methods. 5. Support digital sovereignty engagements by analysing data storage and cross-border flows, cloud and AI service deployment, access and operational controls, and supplier dependencies in the context of clients’ businesses, systems and data flows. Help develop practical approaches that address compliance, security and business continuity needs. 6. Explore practical applications of AI for security, such as assisting security analysis, control assessments, risk identification and knowledge management. Use focused pilots to evaluate accuracy, suitability and practical value. 7. Understand clients’ business objectives, break down problems, gather and analyse evidence, identify root causes and develop practical recommendations. Conduct interviews, provide on-site support, coordinate project activities and prepare deliverables as required, taking ownership of agreed tasks through completion. 8. Proactively use approved AI tools to support research, analysis, drafting and quality reviews. Improve delivery methods, develop reusable knowledge and workflows, and remain accountable for the accuracy, confidentiality and quality of final outputs. Experience and Capabilities 1. A bachelor’s degree or above in cybersecurity, information technology auditing, computer science, information systems management, software engineering, artificial intelligence or a related discipline. Candidates from other disciplines with relevant capabilities and experience will also be considered. 2. One to three years of experience in cybersecurity, data security, personal information protection, industrial control system security, information technology risk management, AI governance or a related field, with a sound foundation in information technology and security. Consulting or client engagement experience is preferred. Senior Consultants should be able to complete analysis and delivery tasks within a defined scope with a degree of independence. 3. Strong structured problem-solving skills: able to clarify objectives and constraints, break down complex issues, form evidence-based judgements and translate analysis into actionable recommendations. Able to make reasonable assumptions, test conclusions and communicate risks promptly when information is incomplete. 4. Learning agility and initiative: willing to engage with unfamiliar business and technology topics, and able to use research, tools, feedback and team expertise to learn key concepts quickly and apply them in practice. 5. Good AI literacy and an open, improvement-oriented mindset: proactively identify opportunities to use AI, frame problems clearly, provide relevant context, iterate prompts and critically verify outputs. Understand AI’s capabilities and limitations, including hallucinations and data security risks, and use AI to improve quality and efficiency in accordance with firm policies and client requirements. Be able to discuss practical examples and lessons learned. 6. Strong written and verbal communication skills in Chinese and English, with the ability to explain analysis and recommendations clearly. A collaborative approach, client service orientation and ownership of delivery, with the ability to provide on-site support as engagements require. 7. Familiarity with frameworks, standards and requirements relevant to cybersecurity, data security, personal information protection, or industrial control system and OT security, with the ability to interpret and apply them in context. 8. Sector-specific requirements (the relevant requirements below apply to the sector for which the candidate is applying): (1) Financial services: a comprehensive and accurate understanding of regulatory requirements relating to cybersecurity and personal information protection, with a strong understanding of how these requirements are implemented in the day-to-day operations and management of financial institutions. A working knowledge of the businesses of financial institutions and good English communication skills are required. (2) Automotive: familiarity with automotive product cybersecurity, ISO/SAE 21434 and Automotive SPICE (ASPICE). Relevant hands-on internal or external audit experience at an original equipment manufacturer (OEM), Tier 1 supplier or consulting firm is preferred. (3) Pharmaceuticals and life sciences: familiarity with core business processes across clinical research, manufacturing and commercial functions, including how data is used and flows across these activities and the associated data security risks. Able to identify data security issues in the context of business needs and develop and help implement practical safeguards. Relevant sector project or practical experience is preferred. Preferred Experience Project, research or practical experience in one or more of the following areas is an advantage: AI security and governance, cybersecurity, data security, industrial control system security, cloud security or personal information protection. Relevant certifications such as CISSP, CISA, CISM, CIPM, CIPP, CISP, AIGP or AAIA are also an advantage.