Hong Kong Cybersecurity & Information Security Bachelor Complete Guide 2026

Why 2026 is the pivotal year to read Cybersecurity in Hong Kong

The convergence of three regulatory and economic shifts has made cybersecurity one of Hong Kong’s most acute talent shortages going into the 2026/27 academic year. First, the Protection of Critical Infrastructure (Computer Systems) Ordinance took full effect on 1 January 2026, mandating that operators of energy, banking, transport, healthcare and telecommunications systems implement formal cybersecurity programmes, appoint dedicated security officers and submit to incident reporting within hours of breach detection. Second, the Hong Kong Monetary Authority’s enhanced cyber resilience framework (C-RAF 2.0) now applies to all Authorized Institutions and licensed virtual asset service providers. Third, the Greater Bay Area’s accelerating digital infrastructure build-out has multiplied cross-border data flows that need protecting.

Industry compensation studies published by Robert Walters, Michael Page and Hays in early 2026 all point in the same direction:

Entry-level cyber security engineers earn 15–20% above general IT roles
Senior cloud security architects command annual packages of HK$1.2 million to HK$1.8 million
Hong Kong’s IT sector is projected to need roughly 100,000 additional workers over the next five years, with cybersecurity consistently ranked as the most under-supplied specialism

For 2026 DSE candidates and for non-local applicants entering through gaokao, A-Level or IB routes, a Hong Kong cybersecurity bachelor’s degree combines three benefits that few other majors stack as cleanly: a recognised credential from a top-100 Asian university, the two-year unconditional IANG visa on graduation, and entry into a career path with structural demand. This guide maps every JUPAS and non-JUPAS pathway into cybersecurity, compares curriculum structures, and lays out concrete admission and career planning advice.

The Hong Kong cybersecurity programme map (2026/27 intake)

Bachelor-level entry routes into cybersecurity in Hong Kong cluster into three architectures:

Dedicated BSc Cybersecurity degrees — the entire four-year programme is built around security, e.g. CityU JS1218 and HKMU JS9719
CS umbrella with a Cybersecurity Stream or Concentration — students enter a broad Computer Science programme and elect security in Year 2 or Year 3, e.g. CityU JS1204, CUHK JS4412, PolyU JS3868
Information Engineering route — heavier emphasis on networking, cryptography and systems-level security, e.g. CUHK JS4446 Information Engineering

The following table summarises the main 2026/27 offerings:

Institution	JUPAS Code	Programme	Year-1 Intake	Local Tuition (per year)
City University of Hong Kong (CityU)	JS1218	BSc Cybersecurity (dedicated degree)	29	HK$47,000
City University of Hong Kong (CityU)	JS1204	BSc Computer Science (Cybersecurity Stream)	~100	HK$47,000
Chinese University of Hong Kong (CUHK)	JS4446	Information Engineering	~56	HK$44,500
Chinese University of Hong Kong (CUHK)	JS4412	Computer Science and Engineering	~64	HK$44,500
Hong Kong Polytechnic University (PolyU)	JS3868	BSc (Hons) Scheme in Computing and AI (CS / EIS with security modules)	~74	HK$44,500
Hong Kong University of Science and Technology (HKUST)	JS5200 series	School of Engineering (CSE with Security Track)	—	HK$44,500
University of Hong Kong (HKU)	JS6963	BEng Computer Science (Cybersecurity concentration)	—	HK$44,500
Hong Kong Metropolitan University (HKMU)	JS9719	BSc (Hons) Cyber and Computer Security	30	HK$50,640 (after NMTSS subsidy)

JUPAS codes occasionally shift between cycles — always verify against the current catalogue at jupas.edu.hk. Non-local tuition typically ranges HK$170,000–200,000 per year.

Deep dives: the programmes that matter

1. CityU JS1218 — BSc Cybersecurity (the flagship dedicated degree)

CityU was the first Hong Kong university to launch a standalone BSc Cybersecurity degree. Offered by the Department of Computer Science, its curriculum is organised around five core pillars that together cover the full security spectrum:

System Security — operating system internals, kernel vulnerabilities, container security
Software Security — secure coding, SDLC, reverse engineering, fuzzing
Cryptography — symmetric and asymmetric primitives, elliptic curve, post-quantum cryptography
Privacy-Enhancing Technologies — differential privacy, homomorphic encryption, federated learning
Cyber Risk Management — ISO 27001, NIST CSF, third-party risk

JUPAS admission requirements (2026 entry):

Chinese Language Level 3, English Language Level 3, Mathematics (Compulsory Part) Level 3
Citizenship and Social Development “Attained”
One designated elective at Level 3 (Biology / Chemistry / Physics / ICT / M1 or M2 Extended Module)

2025 admission data: 1,484 applications (Band A: 210), final offers: 22 (Band A: 10, Band B: 9, Band C: 3). Competition is intense — a Band A first-choice strategy is essentially required, and the best-five score for offered candidates clustered around an average of Level 5 or above. Interview or written assessment is possible.

Graduate destinations: PwC, Deloitte, KPMG and EY cyber consulting practices; HSBC, Standard Chartered and Bank of China (HK) internal security teams; the Hong Kong Police Cyber Security and Technology Crime Bureau (CSTCB); and the Office of the Government Chief Information Officer (OGCIO).

2. HKMU JS9719 — BSc (Hons) Cyber and Computer Security

Hong Kong Metropolitan University (formerly OUHK) is the second institution to offer a dedicated security degree. From the 2026/27 cycle it remains within the NMTSS (Subsidy Scheme for Self-financing Undergraduate Studies in Specified Disciplines), bringing the effective tuition for local students to just HK$50,640 per year after the HK$35,120 government subsidy.

The admission threshold is more accessible, making it especially relevant for students in the DSE mid-band:

Chinese Level 3, English Level 3, Mathematics (Compulsory) Level 2
Citizenship and Social Development “Attained”
Any two electives at Level 2

Curriculum coverage: computer networks, network security, blockchain, IoT security, and digital forensics. The programme aligns closely with CompTIA Security+ and Certified Ethical Hacker (CEH) examinations, and Years 3 and 4 include a 300-hour structured internship with partners that include HKCERT, local banking IT teams and home-grown cybersecurity startups.

3. CUHK JS4446 — Information Engineering

CUHK’s Information Engineering department, founded in 1989, sits at the intersection of networking, cryptography and signal processing, and has long been a centre of gravity for cryptographic research (early Bitcoin work and elliptic curve cryptography both have CUHK fingerprints). From Year 2 students can elect the Information Security concentration, with core courses including:

IERG 4130 Information & Network Security
IERG 4210 Web Programming & Security
IERG 4080 Building Scalable Internet-based Services
Electives including IERG 3033 Operations Research, IERG 3320 Data Communication

Admission level: Band A historical best-five scores cluster around 27–30 out of 35, comparable to JS4412 Computer Science. A strong mathematics background is essential — M1 or M2 is strongly recommended.

4. PolyU JS3868 — Computing and AI broad-based admission

From the 2025/26 cycle PolyU merged its standalone BSc Computing and Enterprise Information Systems (EIS) programmes into JS3868 Computing and AI broad-based admission, with students streaming into Computer Science or EIS at the end of Year 1. Both streams provide:

COMP 4137 Information Security
COMP 4133 Distributed Systems & Cloud Security
COMP 3334 Computer Systems Security
A six-month or one-year Work-Integrated Education (WIE) industrial placement

PolyU has unusually strong industry hooks for security — it runs partnered internship and mentorship pipelines with HKCERT, Hong Kong Police, Cyberport and HKEX.

5. CityU JS1204 — BSc Computer Science (Cybersecurity Stream)

If JS1218 looks too tight on scores, JS1204 is the natural fallback. Students enter under the broad CS umbrella and, at the end of Year 1, choose from five streams: Cybersecurity / AI / Data Science / Multimedia / SE&PM. The Cybersecurity Stream shares many core courses with JS1218 (CS3263 Secure Programming, CS4286 Internet Security), with the main difference being 6–9 additional credits of advanced cryptography and privacy technology in the dedicated degree.

Typical four-year curriculum path

Using CityU JS1218 BSc Cybersecurity as a worked example:

Year 1 — Foundations

Programming (Python / C++), discrete mathematics, linear algebra, computer organisation
University General Education: Chinese, English writing, Information Literacy

Year 2 — Networks and systems

Data structures and algorithms, operating systems, computer networks
Introduction to Cyber Security (CS3263), Web Security (CS3201)

Year 3 — Specialisation

Cryptography (CS4286), System Security (CS4296), Network Attack & Defence (CS4288)
Digital Forensics (CS4287), Privacy Protection (CS4295)
Capstone Project kick-off

Year 4 — Practice and capstone

Advanced electives (blockchain security, AI security, mobile security)
Capstone project (typically co-supervised with industry or a research centre)
Optional six-month internship (Co-op / WIE)

Industry certifications: which exams to layer over the degree

Hong Kong employers heavily reward graduates who pair the degree with industry certifications. A reasonable phasing across four years:

Stage	Recommended Cert	Coverage	Exam Fee
Year 1–2	CompTIA Security+	Security fundamentals, risk management	~US$392
Year 2–3	CEH (Certified Ethical Hacker)	Penetration testing, exploitation	~US$1,199
Year 3	AWS Certified Security – Specialty	Cloud security	US$300
Year 4	CISSP Associate (full status post-graduation)	Comprehensive infosec	US$749
Year 4	OSCP (Offensive Security Certified Professional)	Hands-on penetration	US$1,499

Several programmes (notably PolyU JS3868 and HKMU JS9719) already embed Security+ and CEH content into core courses, and some institutions partially subsidise certification exam fees.

Graduate outcomes and salary (2026 benchmarks)

Starting salary ranges

Drawing on the 2026 Robert Walters, Hays and Michael Page Hong Kong salary surveys:

Graduate entry roles (Security Analyst, SOC Tier-1 Analyst): HK$22,000–28,000/month
Big Four cyber consulting: HK$28,000–35,000/month plus year-end bonus
In-house bank security engineer: HK$30,000–40,000/month
OGCIO Cyber Security Officer (civil service): Master Pay Scale Point 14 (~HK$36,000/month)
Fintech / Web3 security engineer: HK$35,000–55,000/month

After 3–5 years’ experience graduates typically progress to Senior Engineer or Manager level with annual packages routinely above HK$800,000–1,200,000.

Major employer categories

Cybersecurity consulting — PwC, Deloitte, EY, KPMG, Accenture
Financial institutions — HSBC, Standard Chartered, Bank of China (HK), HSBC, AIA
Cloud and big tech — AWS, Microsoft, Google Cloud, Alibaba Cloud HK, Tencent Cloud
Government and public sector — OGCIO, Hong Kong Police CSTCB, ICAC, HKEX, HKMA
Cybersecurity startups and Web3 — SFC-licensed virtual asset platforms with HKMA / SFC security mandates
HKCERT and HKPC — government-backed incident response centres

IANG visa and the path to permanent residency

Non-local graduates (mainland and overseas) qualify for the Immigration Arrangements for Non-local Graduates (IANG) visa on graduation, granting two years of unconditional stay with full freedom to switch employers. Renewals follow the 4+2 pattern. After seven continuous years of ordinary residence, applicants can seek the right of abode. Cybersecurity roles’ high starting salaries and structural demand mean IANG renewal success rates among security graduates sit at the upper end across all majors.

Advice for 2026 DSE candidates and non-local applicants

Elective subject planning (DSE Year 5)

If you’re currently in DSE Year 5 (Form 5) selecting electives, the strongest combination for cybersecurity admission is:

Essential: M1 or M2 Extended Module (foundation for cryptography)
Recommended: Physics (electronic circuits and signal processing intuition)
Bonus: Information and Communication Technology (ICT) — direct alignment with computing fundamentals
Alternative: Chemistry or Biology — bioinformatics and medical data security are emerging adjacencies

Band A allocation strategy

Based on 2025 admission data, JS1218 CityU Cybersecurity showed a Band A conversion of roughly 4.8% (210 applications → 10 offers), comparable to flagship CS programmes. A defensible Band A configuration:

Band A1: JS1218 CityU Cybersecurity (reach / dream choice)
Band A2: JS4446 CUHK Information Engineering or JS4412 CUHK CSE (top-tier fallback)
Band A3: JS3868 PolyU Computing and AI (strong industry certifications)
Band B: JS1204 CityU CS broad admission (Cybersecurity Stream backup)
Band C: JS9719 HKMU Cyber and Computer Security (dedicated degree with NMTSS subsidy)

Non-local applicant routes (gaokao, A-Level, IB)

Gaokao: Apply via the Gaokao Direct Admission scheme to HKU, CUHK, HKUST, CityU, PolyU, HKBU, Lingnan, EdUHK and HKMU; cybersecurity intakes generally roll up under the CS / IE broad umbrella
A-Level / IB: Direct non-JUPAS application — typical thresholds A*AA or IB 38+ for HKU, CUHK and HKUST; A-Level submissions must include Mathematics plus one science
Tuition: Non-local fees are HK$170,000–200,000 per year, with total four-year tuition and living costs roughly HK$1.3–1.6 million
Scholarships: HKU HKSAR Government Scholarship, CUHK Vice-Chancellor’s Scholarship and CityU Jockey Club Scholarship all cover engineering and CS streams, providing HK$80,000 to full coverage per year

Frequently Asked Questions

Q1: Is a dedicated cybersecurity degree better than a general CS degree? If you are already certain you want a security career, the dedicated degrees (CityU JS1218, HKMU JS9719) front-load hands-on coursework and industry placements. If you want to preserve optionality across AI, software engineering and security, a CS umbrella programme (CUHK JS4412, PolyU JS3868, CityU JS1204) with a Cybersecurity Stream is the safer route.

Q2: Must I work in cybersecurity after four years? No. The underlying skills — programming, networking, systems, cryptography — translate directly into SRE, backend engineering, DevOps and AI infrastructure roles. Roughly 30–40% of graduates take their first job outside security, with software engineering the most common landing spot.

Q3: How much mathematics is required? Cryptography-heavy paths need a strong mathematics foundation (number theory, discrete mathematics, linear algebra) — aim for gaokao mathematics 130+ or DSE Mathematics Level 5 with M1 or M2. Systems- and networking-focused paths are less mathematics-intensive but require strong programming fundamentals.

Q4: How important are internships? Critical. Hong Kong’s major employers — Big Four, banks, government — almost exclusively recruit graduates with one or two prior internships in security or adjacent IT roles. Begin applying for HKCERT, Cyberport startups and bank SOC summer placements from the end of Year 2.

Q5: Will cybersecurity jobs be displaced by AI? The adversarial nature of attack and defence means senior security roles (red team, threat hunter, security architect) are among the least replaceable knowledge work in the short term. AI is instead creating new specialisations such as AI security and LLM red teaming. Entry-level SOC Tier-1 monitoring is being augmented by AI co-pilots, so competition at the junior end is intensifying — but aggregate demand continues to climb.

This article is based on publicly available data as of May 2026. JUPAS codes, admission scores and tuition fees may be adjusted before each year’s September JUPAS application deadline. Always verify against the official admissions offices and jupas.edu.hk before finalising your application.