Cybersecurity Consultant

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Cybersecurity Consultant based in Canada. The Cybersecurity Consultant will play a hands-on role in strengthening organizational security and embedding secure development practices across software projects. You will assess existing security controls, identify vulnerabilities, and implement practical improvements across repositories, cloud environments, and CI/CD pipelines. Working closely with engineering teams, you will configure security tools, establish policies, conduct security reviews, and support regulatory compliance initiatives. A key priority will be preparing the organization for ISO/IEC 27001 certification while building a sustainable security framework. You will also mentor an internal Security Lead and help developers adopt security best practices. This is a part-time, fully remote opportunity offering significant flexibility and the chance to shape security operations within an international software environment. Accountabilities: In this role, you will take direct ownership of security improvements, combining technical implementation, governance, compliance, and team enablement. Your main responsibilities will include: - Security assessment and governance: - Conduct security maturity assessments using frameworks such as OWASP SAMM, reviewing repositories, development pipelines, and cloud environments. - Translate assessment findings into prioritized security roadmaps. - Develop and maintain security policies and procedures covering access control, acceptable use, secure development, incident response, vendor management, and AI tool usage. - Maintain security backlogs, risk registers, and performance metrics, providing monthly progress reports to management. - Organizational security and infrastructure: - Configure and enforce Single Sign-On (SSO) and Multi-Factor Authentication (MFA) across email, Git hosting, cloud platforms, CI/CD systems, and Passbolt.

- Review and improve access permissions while establishing onboarding and offboarding procedures. - Strengthen Passbolt security and implement secrets management solutions for applications and pipelines, migrating existing secrets from source code and CI variables. - Implement baseline security measures for employee devices, cloud accounts, backups, and logging systems. - Develop incident response procedures and organize tabletop exercises with the team. - Secure software development: - Design and implement a standardized Secure Software Development Lifecycle (Secure SDLC) based on OWASP ASVS and OWASP SAMM. - Roll out secure development practices across active client projects. - Configure and optimize the SecOps platform, reduce false positives, establish pipeline quality gates, and coordinate vulnerability triage. - Integrate security scanning tools into CI/CD pipelines, including SAST, SCA, secrets scanning, Infrastructure as Code (IaC), container scanning, DAST, and SBOM generation. - Lead threat modeling sessions and document findings for active projects. - Conduct security code reviews of high-risk changes and support developers in resolving vulnerabilities. - Perform internal application security testing before releases and coordinate external penetration testing activities. - Regulatory compliance and certification: - Assess the impact of the EU Cyber Resilience Act (CRA), NIS2, and relevant local regulations on internal operations and client projects. - Establish vulnerability handling and disclosure processes, including support for client CRA reporting obligations. - Lead hands-on ISO/IEC 27001 preparation activities, including defining scope, conducting risk assessments, preparing the Statement of Applicability, developing policies, and collecting compliance evidence.