CEBU CITY, PHILIPPINES — Ernst & Young’s global delivery arm is making a bigger bet on Cebu’s technology workforce, launching an advanced cybersecurity center designed to put Filipino professionals on complex global projects involving artificial intelligence, threat intelligence and cyber engineering.
EY Global Delivery Services, or EY GDS, has established a Cybersecurity Center in Cebu as part of its globally connected, AI-enabled security operations network.
The center will support clients across more than 160 countries, giving Cebu-based professionals exposure to international cyber threats, global technology platforms and increasingly sophisticated digital-security work.
The expansion is significant because EY says its objective is not simply to add more employees.
It wants Filipino workers to move beyond traditional monitoring and analysis roles into areas such as cybersecurity engineering, architecture, artificial-intelligence security, threat intelligence and AI-driven cyber analytics.
That puts Cebu at the center of a much bigger transformation in the Philippine technology-services industry.
For decades, the country built its outsourcing strength around customer service, back-office processing and other labor-intensive services.
Now, as artificial intelligence automates more routine tasks, global companies are increasingly looking for workers capable of handling complex, specialized and higher-value work.
EY’s Cebu investment is therefore not merely a new office story.
It is a test of whether the Philippines can move from being one of the world’s biggest outsourcing centers to becoming a source of globally competitive cybersecurity and AI expertise.
EY Wants Cebu to Handle More Complex Cybersecurity Work
EY GDS Philippines Cybersecurity Leader Maez De Guzman said the changing threat environment is forcing companies to rethink how they build digital defenses.
Businesses are rapidly adopting artificial intelligence, cloud infrastructure and interconnected technology platforms.
Those tools can improve productivity.
But they also expand the number of systems that cybercriminals can potentially target.
EY says modern cybersecurity operations therefore require a combination of people, data, platforms, automation and artificial intelligence.
The Cebu center will give local professionals opportunities to participate in that environment.
Instead of focusing primarily on monitoring alerts, employees could work on building cyber defenses, designing security architectures, analyzing threats and protecting artificial-intelligence systems.
That represents a more technically demanding segment of the cybersecurity market.
Philippines Still Has a Cybersecurity Skills Gap
EY says the Philippine cybersecurity workforce remains concentrated heavily in analytical roles.
The company sees fewer professionals with advanced engineering and architecture skills.
That gap creates both a problem and an opportunity.
If local workers can acquire deeper technical expertise, the Philippines could compete for more sophisticated global cybersecurity projects.
But companies will need workers capable of understanding cloud architecture, threat detection, automation, AI risks and security engineering.
These skills generally require more intensive training than traditional service-delivery roles.
De Guzman said the goal is to create higher-value cyber careers, not simply expand headcount.
That distinction matters.
A larger outsourcing workforce does not necessarily mean the country is moving higher in the technology value chain.
The real test is whether Filipino employees are increasingly performing work that requires specialized expertise and produces more economic value.
EY Already Has Around 800 Risk and Cybersecurity Professionals in the Philippines
SunStar Cebu reported that EY GDS Philippines currently has around 800 professionals in its combined risk and cybersecurity organization.
Approximately 20% are based in Cebu, implying roughly 160 professionals in the city before any future expansion.
Those figures provide a useful sense of scale, but EY has not publicly announced a specific new hiring target for the Cybersecurity Center.
That means it would be inaccurate to describe the launch as creating a particular number of new jobs unless the company later provides such a figure.
EY has instead emphasized the complexity and quality of the work.
The company says success should be measured partly by whether Filipino professionals can solve sophisticated global cybersecurity problems while remaining in the Philippines.
Cebu Is Becoming More Important Beyond Traditional BPO
Cebu has long been one of the Philippines’ biggest outsourcing centers outside Metro Manila.
Its business-process sector expanded because of its universities, English-speaking workforce, office developments and growing technology ecosystem.
But the next phase of growth could look different.
Instead of relying primarily on voice-based customer-service operations, Cebu is increasingly attracting work involving software, artificial intelligence, analytics and cybersecurity.
The EY investment reinforces that shift.
The Freeman reported that EY sees Cebu’s technology talent pool and mature business-services ecosystem as strong foundations for more specialized global delivery.
This is also consistent with broader trends across Philippine global capability centers.
Colliers said this week that the Philippines is increasingly moving from a traditional outsourcing destination toward a strategic global capability hub capable of supporting higher-value functions across technology and other industries.
AI Is Creating New Cybersecurity Threats
Artificial intelligence is one reason cybersecurity work is becoming more complicated.
AI can help security teams process huge amounts of data, identify unusual behavior and automate certain defenses.
But attackers can also use AI.
Cybercriminals can automate phishing campaigns, improve social-engineering messages and rapidly test systems for weaknesses.
Businesses adopting generative AI also create new security concerns involving confidential data, model access and governance.
EY’s Cebu operation specifically includes cybersecurity for AI.
That means professionals may increasingly work on protecting artificial-intelligence systems themselves rather than simply using AI as a defensive tool.
The shift creates demand for people who understand both traditional cybersecurity and emerging AI technologies.
Threat Intelligence Is Becoming More Valuable
Another major focus is threat intelligence.
Threat-intelligence teams gather and analyze information about attackers, malware campaigns, vulnerabilities and emerging cyber risks.
The objective is to help organizations identify threats before they cause major damage.
A multinational company can face attacks originating from many different countries.
That makes global visibility valuable.
Because the Cebu center is connected to EY’s international cybersecurity network, local professionals can gain exposure to threats affecting organizations across multiple markets.
EY says this international exposure could help Filipino employees develop expertise that is relevant beyond the domestic market.
That could strengthen the Philippines’ competitiveness as companies search globally for cybersecurity talent.
University Partnerships Will Be Critical
EY is also working with universities to strengthen its talent pipeline.
The company has partnered with the Cebu Institute of Technology-University on a cybersecurity curriculum.
The program incorporates laboratory simulations, industry frameworks and scenarios based on real-world cybersecurity situations.
The objective is to reduce the gap between classroom education and what employers need.
That gap is particularly important in cybersecurity.
A student may understand theoretical computer concepts but still require practical experience working with security platforms, threat data and incident-response tools.
EY says university-industry cooperation can expose students to more realistic cybersecurity environments before they enter the workforce.
EY Works With More Than 40 Cybersecurity Technology Partners
The Cebu team will also gain exposure to EY’s network of technology alliances.
SunStar reported that EY maintains more than 40 cybersecurity technology-alliance relationships.
De Guzman cited companies including Microsoft, Cisco and CrowdStrike as examples of technology partners that can support training and technical exposure.
These relationships matter because cybersecurity technology changes extremely quickly.
Professionals must continually learn new tools and security approaches.
A platform that dominates the market today could change substantially within several years.
Attackers also evolve.
That means cybersecurity careers require continuous reskilling rather than one-time technical training.
Critical Thinking Could Become More Valuable Than Routine Technical Work
One of EY’s strongest messages concerns the skills workers will need.
De Guzman emphasized critical thinking and continuous learning.
That reflects a broader change caused by automation.
Artificial intelligence can increasingly perform routine technical tasks.
But more complicated cybersecurity work requires judgment.
A security professional may need to determine whether unusual network behavior represents an attack.
They may have to decide how serious a vulnerability is.
They may need to balance security requirements against business needs.
Those tasks are difficult to automate completely because they involve context and decision-making.
That could make advanced cybersecurity relatively resilient as AI changes the broader IT-services workforce.
Non-IT Professionals Could Also Find Opportunities
Cybersecurity is not limited to programmers.
EY says people from non-technical backgrounds can also enter parts of the industry.
Examples include compliance, risk management, privacy and AI governance.
Those roles require knowledge of regulations, organizational policies and business risks.
For the Philippines, that could broaden the talent pool.
Workers from legal, finance, accounting or business backgrounds may be able to transition into cyber-risk roles through additional training.
However, engineering and architecture positions still generally require deeper technical knowledge.
The cybersecurity industry therefore includes a wide spectrum of careers rather than a single job category.
Philippine IT-BPM Industry Is Trying to Move Up the Value Chain
EY’s Cebu expansion fits directly into the strategy being pursued by the wider Philippine IT-BPM sector.
The IT and Business Process Association of the Philippines projects that the industry could generate between $43.3 billion and $50.5 billion in annual revenue by 2028.
Employment is projected at between 1.85 million and 2.14 million full-time workers.
But the industry’s leaders say the future should not be judged only by how many workers it employs.
IBPAP President and CEO Jack Madrid has argued that the next stage of growth will increasingly depend on the value created by each worker.
Routine functions are becoming easier to automate.
Companies therefore need workers who can combine AI tools with industry expertise, judgment, leadership and specialized knowledge.
Cybersecurity fits precisely into that strategy.
Higher-Value Work Could Also Mean Better Career Opportunities
More specialized services generally require more expertise.
That can create stronger career paths for workers.
An employee who begins in security analysis could potentially move into engineering, architecture, threat intelligence or governance.
These roles can carry greater responsibility because they influence how global businesses protect systems and data.
For Cebu, that creates an opportunity to retain skilled workers who might otherwise believe they need to move to Metro Manila or overseas to gain international experience.
EY’s message is that globally relevant cybersecurity careers should be available locally.
If successful, that could help Cebu strengthen its reputation not simply as a lower-cost delivery center but as a source of specialized technical expertise.
The Bigger Challenge Is Keeping Skills Current
However, the technology industry moves quickly.
The skills that companies need today may not be the same skills they need five years from now.
Cloud platforms evolve.
Artificial-intelligence models improve.
Cyberattacks become more sophisticated.
New regulations emerge.
That creates a continuous training challenge for both employers and workers.
Universities may also struggle to update curricula at the same speed as industry.
This is why EY is emphasizing ongoing learning and partnerships between companies and schools.
Without continuous skills development, the Philippines could struggle to capture the higher-value work it is trying to attract.
Cebu Is Competing With Global Technology Hubs
EY’s cybersecurity clients can potentially be served from multiple countries.
That means Cebu is not only competing with Manila.
It is competing with technology and delivery centers in India, Eastern Europe, Latin America and other Asian markets.
Those locations may also offer large technical workforces and established cybersecurity capabilities.
The Philippines therefore cannot rely solely on lower labor costs.
It must compete through skills, reliability, innovation and access to specialized talent.
EY’s decision to establish a cybersecurity center in Cebu suggests the company believes the city has enough of those qualities to play a larger role.
But future expansion will depend on performance.
Cybersecurity Demand Is Growing as the Digital Economy Expands
The Philippines is also becoming more digitally dependent.
Online banking, e-commerce, cloud computing, digital payments and data-center expansion increase the amount of valuable information moving through digital systems.
That creates opportunities for technology companies.
It also increases cybersecurity risks.
Recent growth in domestic data-center investment, for example, is creating additional demand for engineers, IT specialists and security professionals because sensitive corporate and consumer information needs to be protected.
As more businesses digitize, cybersecurity becomes less of a specialized IT concern and more of a basic business requirement.
That could support long-term demand for professionals capable of defending digital infrastructure.
EY’s Cebu Bet Is Really About Capability, Not Headcount
The most important message from the launch is what EY is not promising.
The company is not presenting the center primarily as a mass-hiring project.
It has not announced thousands of new jobs.
Instead, it is focused on building deeper technical capability.
That makes the project different from the traditional outsourcing expansion story.
For decades, Philippine economic headlines frequently celebrated the number of seats or jobs created by a new BPO facility.
EY is measuring success differently.
Its stated objective is for Cebu professionals to work on sophisticated international cybersecurity problems using AI, automation and advanced analytics.
That is a more difficult goal.
But if achieved, it could create significantly more strategic value.
Can Cebu Become a Global Cybersecurity Hub?
Cebu already has many of the ingredients.
It has universities.
It has an established outsourcing ecosystem.
It has a growing technology workforce.
And it has multinational companies operating global delivery centers.
EY is now betting that those advantages can support more specialized cybersecurity work.
The challenge is developing enough engineers, architects, threat-intelligence specialists and AI-security professionals to meet global demand.
That will require sustained investment in training.
It will require universities to keep curricula current.
And it will require companies to give Filipino professionals access to complex global projects rather than limiting them to routine support work.
EY’s cybersecurity center gives Cebu an opportunity to move higher in the global technology-services value chain.
But the bigger question is whether the Philippines can develop specialized talent fast enough to turn individual investments like this into a broader transformation of its outsourcing economy.
