Cybersecurity Consultant

This is a fully remote position, open to applicants anywhere in the world.

📋 Description

• Conduct a security maturity evaluation, assess repositories, pipelines, and cloud configurations, and develop a prioritized action plan.

• Develop essential security policies and procedures addressing access control, acceptable usage, secure development, incident response, vendor management, and AI tool utilization.

• Oversee the security backlog, maintain the risk register and progress metrics, and provide monthly reports to management.

• Set up and enforce Single Sign-On (SSO) and Multi-Factor Authentication (MFA) across email, Git hosting, cloud services, CI/CD, and Passbolt.

• Review and rectify access permissions, and create onboarding and offboarding checklists.

• Strengthen Passbolt and implement a secrets management solution, including migrating secrets away from code and CI variables.

• Execute baseline hardening procedures for laptops, cloud accounts, backups, and logging mechanisms.

• Draft the incident response strategy and conduct tabletop exercises.

• Establish and implement a Secure Software Development Life Cycle (SDLC) in accordance with OWASP ASVS and OWASP SAMM.

• Configure and optimize the SecOps platform, minimize false positives, set up pipeline quality gates, and manage findings.

• Integrate SAST, SCA, secrets scanning, Infrastructure as Code (IaC) scanning, container scanning, Dynamic Application Security Testing (DAST), and SBOM generation into CI/CD pipelines.

• Facilitate threat modeling sessions and document outcomes.

• Conduct security code reviews for high-risk changes and assist developers in addressing vulnerabilities.

• Perform internal security assessments prior to releases and coordinate external penetration testing.

• Align the EU Cyber Resilience Act, NIS2, and pertinent local regulations with the company and its clients.

• Establish processes for vulnerability management and disclosure, including support for clients’ CRA reporting requirements.

• Prepare for ISO/IEC 27001 certification by defining scope, conducting risk assessments, creating a Statement of Applicability, drafting policies and evidence, and coordinating with certification bodies.

• Assist in defining security service tiers for client proposals.

• Complete client security questionnaires and develop reusable response sets.

• Participate in selected client meetings as a senior security representative.

• Collaborate with the internal Security Lead to facilitate their transition to daily ownership.

• Conduct internal workshops on OWASP Top 10, threat modeling, and secure CI/CD practices.

• Recommend training and certification pathways for developers, Security Champions, and DevOps engineers.

⛳️ Requirements

• Over 8 years of experience in information security, with recent practical involvement in application security, DevSecOps, or cloud security.

• Proficient in configuring security tools, writing pipeline configurations, reviewing code, testing applications, and developing policies.

• Hands-on experience in establishing a secure development lifecycle and integrating security tools into CI/CD workflows.

• Strong knowledge of cloud security in at least one leading cloud platform: AWS, Azure, or GCP.

• Capable of articulating security risks in straightforward terms to engineers and management.

• Fluent in English, both written and verbal.

• Experience with Kubernetes and container security.

• Familiarity with security risks associated with AI and LLM-based applications.

• Experience with the EU Cyber Resilience Act, NIS2, and GDPR in the context of a software vendor or supplier (preferred).

• Background in developing security offerings for clients within an agency or outsourcing setting (preferred).

• Experience in implementing or auditing ISO/IEC 27001 or a similar framework like SOC 2 (preferred).

• Relevant hands-on certifications such as OSCP, BSCP, CDP, or CKS (preferred).

• ISO/IEC 27001 Lead Implementer or Lead Auditor certification (preferred).

• Cloud security certifications such as AWS Security Specialty, AZ-500, or Google Professional Cloud Security Engineer (preferred).

• CISSP, CISM, or CSSLP certification (preferred).

🏝️ Benefits

• Sponsored training and additional professional development opportunities.

• Access to the latest technologies and a knowledgeable team.

• Flexible working hours with the option to choose preferred schedules.

• Remote work opportunities from any location.

• A steady stream of engaging and challenging projects.

• Annual salary increases based on performance.

• Monthly payments via wire transfer for contractors.