Security Consultant

Job Summary

As an Information Security Consultant, the individual will be responsible for providing security guidance to projects and operations teams responsible for delivering, respectively maintaining, IT cloud-based solutions. The Consultant will support the entire system development lifecycle (SDLC) of business IT solutions with information security expertise and guidance. This includes performing a risk assessment of the solution and the underpinning cloud infrastructure in order to derive adequate risk treatment options, driving the security assurance activities with cloud vendors, specifying and prioritizing security requirements, directing the design of security controls, supervising the security attestation activities and effectively articulating all related findings, issues, recommendations to team members and management, assessing the security impact of change requests and providing the operations teams with related recommendations and decisions.

The successful candidate should have solid background in web services architecture and design, networking principles supporting hybrid cloud models, experience in applications development processes and methodologies (experience in agile application development and DevOps operations mode is strongly preferred), as well as oversight knowledge of infrastructure and hosting technologies leveraging virtualization and containerization. The successful candidate should have broad consulting or security assurance experience across all Information Security knowledge areas relevant to modern cloud-based architectures.

The Security Consultant reports to Deputy CISO of Enterprise Workplace Technology in a hands-on role, focused on the secure design, architecture and development for applications, which processes sensitive data and constitutes core as well as critical business services. The Security Consultant s role is a technical position which will support the global strategies and architecture vision as it relates to the development of secure design, build, deployment and operation of business applications and related infrastructure.

The opportunity

The Security Consultant works directly with Architects, Developers, IAM engineers, Project Managers and other resources; through collaboration and mentoring, they help teams to deliver secure business solutions. The Security Consultant s role is a technical position which will support the global strategies and architecture vision as it relates to the development of secure design, build, deployment and operation of business applications and related infrastructure.

Your key responsibilities

This position is an individual contributor capable of supporting multiple project teams in the design, implementation and validation of security controls across applications and services (incl. underpinning infrastructure and cloud hosting platform), as well as providing the operations teams with consultancy, reviews and decisions upon deployment of changes to existent operational services. The core responsibilities are as listed in the following.

• Directing and managing solution-specific information security assurance efforts with 3rd parties and vendors, like backend reviews, controls verification and validation, etc., oriented on standards and frameworks like ISO, COBIT, NIST, TSC, etc.
• Risk assessments (threats, vulnerabilities) of cloud services and applications
• Risk assessments of cloud hosting infrastructure underpinning the services and applications
• Security assessment of architecture and networking supporting the services and applications
• Derivation of risk treatment options from risk assessments and effectively facilitating the implementation of the optimal security-usability trade-off in interactions with project teams and management
• Identifying, specifying and prioritizing security requirements in new applications and services deployment, as well as specifying and facilitating security changes in DevOps operations mode of existent applications
• Directing the design of security controls to satisfy the approved security requirements
• Supervising and managing various types of security attestation activities (scans, pentests, audits), including the definition of scope, pass criteria, contribution to test scenarios, articulating and formalizing findings and decisions
• Assessing the security posture impact of change requests and providing the operations teams with related recommendations and decisions
• Effectively communicating the findings, recommendations and decisions from all above activities, by adapting the form and depth of statements adequately to audiences and stakeholders
• Translating technical security terms and concepts into business risk terminology to facilitate making objective and security-aware risk decisions by management
• Providing knowledge sharing and technical assistance to other team members
• Acting as an agile team member according to established agile development best practices and guidelines

Skills and attributes for success

The position requires knowledge of various IT system architectures and technologies like cloud, virtualization, containerization, mobile, as well as expertise and experience in security subject matter areas such as IAM, network and perimeter security, web applications security, user account management, privileged access, auditing & logging, and others as outlined in ISO 27001, OWASP, NIST and related guidelines and standards. The consultant filling the position should also have experience in conduction of 3rd party security assessments, in particular within the scope of SOC1, SOC2 reports, and in vendor risk management.

A successful candidate should have significant security working experience and knowledge in the design, implementation and operation of security controls in any two or more of the following areas:

Disclaimer: This job posting has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.