Work Across
Get started
All jobs
Save

Remote Cybersecurity Consultant

Scopic
Contract type
Part-time
Work mode
Remote
Experience
Senior · 8+ years

Job description

A hands-on, part-time security role at Scopic to build and run a secure development lifecycle, harden the company's own security posture, and prepare for ISO/IEC 27001 certification while mentoring an internal Security Lead.

At a glance

Employment
Part-time · Independent contractor
Work mode
Remote
Languages
English – fluent

What you'll do

  • Run the security maturity assessment yourself (for example OWASP SAMM), review repositories, pipelines and cloud setup, and turn the findings into a prioritized roadmap
  • Write core security policies and procedures: access control, acceptable use, secure development, incident response, vendor and AI tool usage
  • Set up and maintain the security backlog, risk register and progress metrics, and report progress to management monthly
  • Configure and enforce SSO and MFA across email, Git hosting, cloud consoles, CI/CD and Passbolt
  • Review and fix access rights, and set up onboarding and offboarding checklists
  • Harden the Passbolt setup and implement a secrets manager for applications and pipelines, including migrating existing secrets out of code and CI variables
  • Implement baseline hardening for laptops, cloud accounts, backups and logging
  • Write the incident response plan and run tabletop exercises with the team
  • Build the standard Secure SDLC, based on OWASP ASVS and OWASP SAMM, and roll it out on real client projects
  • Configure and tune the SecOps platform: reduce false positives, set up pipeline quality gates and triage findings together with the teams
  • Add the missing scanning to CI/CD pipelines: SAST, SCA, secrets scanning, IaC and container scanning, DAST and SBOM generation
  • Run threat modeling sessions on active projects and document the results
  • Do security code reviews of high-risk changes and help developers fix vulnerabilities
  • Perform internal security testing of applications before releases, and scope and coordinate external penetration tests
  • Map how the EU Cyber Resilience Act (CRA), NIS2 and relevant local regulations affect the company and its clients
  • Write and implement the vulnerability handling and disclosure process, including support for clients' CRA reporting obligations
  • Do the hands-on ISO/IEC 27001 preparation work: scope, risk assessment, Statement of Applicability, policies and evidence, and work with the certification body
  • Help define security service tiers to include in client proposals
  • Fill in client security questionnaires and build a reusable answer set
  • Join selected client meetings or calls as a senior security voice when needed
  • Work side by side with the internal Security Lead so they learn by doing
  • Run short internal workshops on key topics (for example OWASP Top 10, threat modeling, secure CI/CD)
  • Recommend training and certification paths for developers, Security Champions and DevOps engineers

What we're looking for

  • 8+ years of experience in information security, with recent hands-on work in application security, DevSecOps or cloud security
  • Comfortable doing the work yourself: configuring security tools, writing pipeline configuration, reviewing code, testing applications and writing policies
  • Practical experience setting up a secure development lifecycle and integrating security tools into CI/CD pipelines
  • Good knowledge of cloud security in at least one major cloud (AWS, Azure or GCP)
  • Ability to explain security risks in plain language to both engineers and management
  • Fluent English, written and spoken
  • Kubernetes and container security experience
  • Knowledge of security risks in AI and LLM-based applications

Nice to have

  • Experience with the EU Cyber Resilience Act, NIS2 and GDPR in a software vendor or supplier context
  • Experience building security offerings for clients in an agency or outsourcing environment
  • Experience implementing or auditing ISO/IEC 27001 (or a comparable framework such as SOC 2)
  • Hands-on certifications such as OSCP, BSCP, CDP or CKS
  • ISO/IEC 27001 Lead Implementer or Lead Auditor
  • Cloud security certification (AWS Security Specialty, AZ-500 or Google Professional Cloud Security Engineer)
  • CISSP, CISM or CSSLP

How to get hired

  1. 1Identity verification process as part of the hiring process

Apply

Save

About Scopic

Key facts

  • Contractors are paid monthly via wire transfer
  • Hourly paid position
  • Annual pay increases for good performance
  • Paid training and professional opportunities
  • Remote professionals from around the world

What they value

  • Equal-opportunity employer valuing diversity