Remote Cybersecurity Consultant

Responsibilities

• Assessment and governance
• Run the security maturity assessment yourself (for example OWASP SAMM), review our repositories, pipelines and cloud setup, and turn the findings into a prioritized roadmap.
• Write our core security policies and procedures: access control, acceptable use, secure development, incident response, vendor and AI tool usage.
• Set up and maintain the security backlog, risk register and progress metrics, and report progress to management monthly.
• Company security ("secure the house")
• Configure and enforce SSO and MFA across email, Git hosting, cloud consoles, CI/CD and Passbolt.
• Review and fix access rights, and set up onboarding and offboarding checklists.
• Harden our Passbolt setup and implement a secrets manager for applications and pipelines, including migrating existing secrets out of code and CI variables.
• Implement baseline hardening for laptops, cloud accounts, backups and logging.
• Write the incident response plan and run tabletop exercises with the team.

Languages

Required

• 8+ years of experience in information security, with recent hands-on work in application security, DevSecOps or cloud security.
• Practical experience setting up a secure development lifecycle and integrating security tools into CI/CD pipelines.
• Good knowledge of cloud security in at least one major cloud (AWS, Azure or GCP).
• Kubernetes and container security experience.
• Knowledge of security risks in AI and LLM-based applications.

Nice to have

• Fluent English, written and spoken.
• Experience with the EU Cyber Resilience Act, NIS2 and GDPR in a software vendor or supplier context.
• Hands-on certifications such as OSCP, BSCP, CDP or CKS
• I consent that the data provided in this form, and the attached CV, will be used for Scopic's recruiting purposes and email communications.