Cybersecurity Consultant L3

The Cybersecurity Consultant (L3) is an advanced consulting role responsible for assessing cybersecurity risks, control effectiveness, compliance posture and cloud security across client environments.

The primary objective of this role is to independently plan and perform security assessments, identify control gaps and vulnerabilities, and provide clear, evidence-based recommendations that support risk treatment and compliance outcomes.

The Cybersecurity Consultant (L3) focuses on complex security risk assessments, IM8/security compliance, vulnerability assessment (VA), security configuration review, audit, cloud security posture management (CSPM), incident management, vulnerability management and cloud security. The consultant must be sufficiently independent from personnel implementing the controls being assessed.

This role may also contribute to or support project work as and when required.

Key Responsibilities:

· Plans and conducts cybersecurity risk assessments across infrastructure, applications and cloud environments.

· Assesses compliance against IM8and other applicable security requirements using documented evidence and defined assessment criteria.

· Performs vulnerability assessments and security configuration reviews, analyses findings and validates risk and remediation priorities.

· Supports security audits by preparing assessment plans, reviewing evidence, documenting observations and tracking findings to closure.

· Reviews cloud security posture through CSPM findings and evaluates cloud security risks and control gaps.

· Supports incident management activities, including assessment of security impact, coordination of actions and documentation of outcomes.

· Coordinates vulnerability management activities, including review, prioritization, remediation tracking and risk acceptance inputs.

· Produces clear assessment reports that describe scope, evidence, findings, risk impact and recommended corrective actions.

· Maintains sufficient independence from personnel implementing the controls being assessed and highlights potential conflicts of interest.

· Communicates assessment results and security risks to client stakeholders and relevant delivery teams.

· Tracks assigned actions and deliverables to completion within agreed timelines and service requirements.

· Contributes to knowledge sharing, assessment templates and continuous improvement of cybersecurity consulting practices.

· Performs any other related task as required.

Knowledge and Attributes:

· Ability to work independently and maintain objectivity when assessing control design and operating effectiveness.

· Strong analytical skills with the ability to connect technical findings to security, risk and compliance impact.

· Ability to communicate complex cybersecurity risks clearly to technical and non-technical stakeholders.

· Strong report writing, evidence review and stakeholder management skills.

· Ability to work across different cultures and social groups.

· Ability to plan activities well in advance and adapt to changing circumstances.

· Ability to work well in a pressurized environment while maintaining quality and professional judgement.

· Strong client service orientation and commitment to accurate, evidence-based outcomes.

Academic Qualifications and Certifications:

· Bachelor's degree or equivalent qualification in IT/Computing (or demonstrated equivalent work experience).

· Certifications relevant to the services provided carry additional weightage on a candidate’s qualification for the role.

· Required certification(s):

· CISSP, CRISC, or equivalent certification.

· Good-to-have certification(s):

· CISA.

· CGEIT.

· AWS Certified Security -Specialty.

Required Experience:

· 6+ years of overall relevant experience.

· 5+ years of experience in Cybersecurity Consulting, Risk, Compliance, VA and Cloud Security.

· Demonstrated experience insecurity risk assessment, IM8/security compliance, VA, security configuration review, audit, CSPM, incident management, vulnerability management and cloud security.

· Demonstrated ability to perform assessments independently from personnel implementing the controls being assessed.

Required scope:

Security consulting: Security risk assessment; control assessment; evidence review; risk reporting

Compliance and audit: IM8/security compliance; audit support; finding tracking

Technical assurance: VA; security configuration review; vulnerability management

Cloud security: CSPM; cloud security assessment

Security operations interface: Incident management; remediation coordination