Background
Within a large-scale enterprise cybersecurity landscape, this consultant role supports a wide range of security engineering and assessment activities across multiple digital products and platforms, hosted both in the cloud and on-premises. The focus is on making security a built-in quality aspect by working closely with product, platform and architecture teams to embed security by design.
Scope of the consultant services
Enterprise application security
- Identify and onboard applications into the security governance model.
- Support threat modelling and security gate checks for key products.
- Help create simple dashboards and metrics showing security and privacy posture.
Vulnerability management
- Onboard cloud and on-premises assets into vulnerability management tools.
- Support risk-based triage and prioritisation of vulnerabilities with clear SLAs.
- Contribute to patching and hardening initiatives and report on key metrics such as aging, trends and severity.
DevSecOps and runtime security
- Help teams embed security controls and checks into CI/CD pipelines and define practical security quality gates.
- Support and lead security assessments for key applications and platforms.
- Improve endpoint, network and identity security in collaboration with engineering and operations teams.
- Contribute to resilience and recovery planning so critical services can withstand and recover from cyber incidents.
Third-party risk management
- Support a lightweight intake process for third-party and vendor solutions.
- Review vendor security documentation against security expectations.
- Help run recurring gate checks so that security, privacy and compliance requirements are met before and after go-live.
Desired knowledge, experience, competence and skills
- 7+ years of experience in cybersecurity or security engineering roles in medium to large organisations.
- Hands-on experience with security engineering across cloud and on-premises infrastructure, such as Azure, AWS or GCP.
- Good understanding of application security and common vulnerabilities, including OWASP Top 10, with experience in basic security testing or penetration testing.
- Practical experience integrating security into CI/CD pipelines using GitHub Actions, GitLab CI, Jenkins or similar.
- Experience with vulnerability management tools and risk-based triage using CVSS, CISA KEV or similar scoring.
- Familiarity with frameworks and regulations including NIST CSF, ISO 27001, NIS2, GDPR and PCI-DSS.
- Ability to translate technical security findings into clear, actionable guidance for engineers and product teams.
- Collaborative mindset and experience working with cross-functional teams across product, engineering, operations and risk.
- CISSP.
What 3 things are most important?
- Strong practical experience with vulnerability management and infrastructure security across cloud and on-premises environments.
- Proven ability to design and operationalise security gate-check processes and intake frameworks supporting risk assessments for internal and third-party products.
- Capability to translate security risks and findings into clear, prioritised actions for product and platform teams.
What you will love about working here
- Health insurance from the first days, regardless of the probationary period.
- Christmas holidays from 25 December to 31 December.
- Cooperation with the Superhumans Center and Veteran HUB.