Responsibilities

Plans and conducts cybersecurity risk assessments across infrastructure, applications and cloud environments.
Assesses compliance against IM8 and other applicable security requirements using documented evidence and defined assessment criteria.
Performs vulnerability assessments and security configuration reviews, analyses findings and validates risk and remediation priorities.
Supports security audits by preparing assessment plans, reviewing evidence, documenting observations and tracking findings to closure.
Reviews cloud security posture through CSPM findings and evaluates cloud security risks and control gaps.
Supports incident management activities, including assessment of security impact, coordination of actions and documentation of outcomes.
Coordinates vulnerability management activities, including review, prioritisation, remediation tracking and risk acceptance inputs.
Produces clear assessment reports that describe scope, evidence, findings, risk impact and recommended corrective actions.
Maintains sufficient independence from personnel implementing the controls being assessed and highlights potential conflicts of interest.
Communicates assessment results and security risks to client stakeholders and relevant delivery teams.
Tracks assigned actions and deliverables to completion within agreed timelines and service requirements.
Contributes to knowledge sharing, assessment templates and continuous improvement of cybersecurity consulting practices.
Performs any other related task as required.

Requirements

Bachelor's degree or equivalent qualification in IT/Computing
6+ years of relevant experience with 5+ years of experience in Cybersecurity Consulting, Risk, Compliance, VA and Cloud Security.
Demonstrated experience in security risk assessment, IM8/security compliance, VA, security configuration review, audit, CSPM, incident management, vulnerability management and cloud security.
Demonstrated ability to perform assessments independently from personnel implementing the controls being assessed.
Strong analytical skills with the ability to connect technical findings to security, risk and compliance impact.
Ability to communicate complex cybersecurity risks clearly to technical and non-technical stakeholders.
Strong report writing, evidence review and stakeholder management skills.
Required certification: CISSP, CRISC, or equivalent certification.
Good-to-have certification: CISA / CGEIT / AWS Certified Security - Specialty.