Cybersecurity Consultant (Application & Cloud)

Responsibilities

• Conduct cybersecurity risk assessments and security reviews of applications, IT systems, infrastructure, APIs, and cloud services.
• Review system architectures, data flows, interfaces, and security controls to identify potential vulnerabilities and risks.
• Apply application security best practices, including OWASP Top 10 and OWASP Application Security Verification Standard (ASVS).
• Perform source code security reviews using SAST tools such as Fortify on Demand and SonarQube.
• Support secure software development through Agile, CI/CD, and DevSecOps practices, including automated security testing.
• Conduct threat modelling to identify, assess, and mitigate application security risks.
• Track vulnerabilities, review remediation plans, and ensure timely patching and closure of identified security issues.
• Monitor and investigate cybersecurity alerts and incidents, supporting incident triage, containment, remediation, recovery, and post-incident reviews.
• Conduct security awareness training and promote good cybersecurity practices across the organisation.
• Collaborate with technical teams and stakeholders to improve security controls and ensure compliance with established requirements.

Requirements

• At least 5 years of combined experience in software development, application security, and cloud computing, such as AWS.
• Good understanding of mobile and web application architectures, APIs, REST, SOAP, and SSL/TLS.
• Strong knowledge of application security principles, vulnerability management, and industry best practices.
• Familiarity with CI/CD pipelines, DevSecOps tools, and platforms such as GitLab, GitHub, and Ansible.
• Experience using SAST tools such as Fortify on Demand or SonarQube.
• Strong analytical, problem-solving, troubleshooting, and communication skills, with the ability to work independently and collaborate with stakeholders.
• Degree in a relevant discipline or equivalent qualification.
• Relevant certifications such as CISSP, OSCP, CCSP, CRISC, or AWS security certifications are preferred.
• Experience with Government Commercial Cloud (GCC) is an advantage