Senior Security Consultant

The Role

You will serve as a technical security consultant embedded across multiple client engagements. You will lead your own workstreams, scope the work, and see it through to delivery.

Our engagements span cloud security, application security, and security engineering, along with the technical side of compliance. Endpoint, identity, and SaaS administration sits with our Senior Corporate Security Consultant role.

What You Will Do

• Lead cloud security work: configuration reviews, IAM design, network segmentation, and hardening across AWS, GCP, and Azure
• Lead application security work: secure SDLC programs, threat modeling, code review, and CI/CD pipeline security alongside client engineering teams
• Lead technical security assessments: vulnerability assessments and security architecture reviews of client systems
• Implement and run security tooling: deploy and tune EDR, SIEM, CSPM, and vulnerability scanning in client environments, then triage findings and drive remediation with client engineers
• Design security programs: build security roadmaps, develop security architectures, and advise clients on technical control implementation for compliance frameworks (SOC 2, ISO 27001, HIPAA)
• Own client relationships: run your own workstreams, lead client meetings, provide weekly status updates, and manage expectations directly with client stakeholders
• Produce executive-quality deliverables: assessment reports, security roadmaps, architecture documentation, and remediation plans ready for client leadership without heavy editing

What We Require

• 5-7 years of hands-on experience in cybersecurity. Actual technical security delivery
• Prior consulting or professional services experience is mandatory. You must have managed multiple clients, scoped your own work, and communicated directly with stakeholders

Deep expertise in at least two of the following:

• Cloud security (AWS, GCP, and/or Azure: IAM, networking, security services, configuration hardening)
• Application security (secure SDLC, threat modeling, code review, CI/CD pipeline security)
• Infrastructure security (containers, Kubernetes, infrastructure as code, secrets management)
• Detection and response (EDR, SIEM, vulnerability management, incident response)

• Working knowledge of compliance frameworks: you must understand what SOC 2 Type II and ISO 27001 require technically, well enough to implement the controls yourself
• Strong technical writing skills: SOPs, assessment reports, architecture documents. If your writing needs significant editing, this isn't the right fit
• Professional-level English: written and verbal. You will be on client calls with US-based engineering and leadership teams daily

What Sets You Apart

• You've led engagements from scoping through delivery
• You can walk into a client's AWS environment and within a day tell them what's wrong and what to fix
• You've worked alongside engineering teams to fix security issues in production code and deployment pipelines
• You've taken a security program from roadmap to operational
• You have certifications like CISSP, OSCP, AWS Security Specialty, or equivalent (not required, but signals depth)