pbThis position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Cybersecurity Consultant based in Italy. /b /ppThe Cybersecurity Consultant will play a hands-on role in strengthening organizational security and embedding secure development practices across software projects. You will assess existing security controls, identify vulnerabilities, and implement practical improvements across repositories, cloud environments, and CI/CD pipelines. Working closely with engineering teams, you will configure security tools, establish policies, conduct security reviews, and support regulatory compliance initiatives. A key priority will be preparing the organization for ISO/IEC 27001 certification while building a sustainable security framework. You will also mentor an internal Security Lead and help developers adopt security best practices. This is a tempo parziale, fully remote opportunity offering significant flexibility and the chance to shape security operations within an international software environment. /ph3Accountabilities: /h3ullipSecurity assessment and governance: /pullipConduct security maturity assessments using frameworks such as OWASP SAMM, reviewing repositories, development pipelines, and cloud environments. /p /lilipTranslate assessment findings into prioritized security roadmaps. /p /lilipDevelop and maintain security policies and procedures covering access control, acceptable use, secure development, incident response, vendor management, and AI tool usage. /p /lilipMaintain security backlogs, risk registers, and performance metrics, providing monthly progress reports to management. /p /li /ul /lilipOrganizational security and infrastructure: /pullipConfigure and enforce Single Sign-On (SSO) and Multi-Factor Authentication (MFA) across email, Git hosting, cloud platforms, CI/CD systems, and Passbolt. /p /lilipReview and improve access permissions while establishing onboarding and offboarding procedures. /p /lilipStrengthen Passbolt security and implement secrets management solutions for applications and pipelines, migrating existing secrets from source code and CI variables. /p /lilipImplement baseline security measures for employee devices, cloud accounts, backups, and logging systems. /p /lilipDevelop incident response procedures and organize tabletop exercises with the team. /p /li /ul /lilipSecure software development: /pullipDesign and implement a standardized Secure Software Development Lifecycle (Secure SDLC) based on OWASP ASVS and OWASP SAMM. /p /lilipRoll out secure development practices across active client projects. /p /lilipConfigure and optimize the SecOps platform, reduce false positives, establish pipeline quality gates, and coordinate vulnerability triage. /p /lilipIntegrate security scanning tools into CI/CD pipelines, including SAST, SCA,



secrets scanning, Infrastructure as Code (IaC), container scanning, DAST, and SBOM generation. /p /lilipLead threat modeling sessions and document findings for active projects. /p /lilipConduct security code reviews of high-risk changes and support developers in resolving vulnerabilities. /p /lilipPerform internal application security testing before releases and coordinate external penetration testing activities. /p /li /ul /lilipRegulatory compliance and certification: /pullipAssess the impact of the EU Cyber Resilience Act (CRA), NIS2, and relevant local regulations on internal operations and client projects. /p /lilipEstablish vulnerability handling and disclosure processes, including support for client CRA reporting obligations. /p /lilipLead hands-on ISO/IEC 27001 preparation activities, including defining scope, conducting risk assessments, preparing the Statement of Applicability, developing policies, and collecting compliance evidence. /p /lilipCoordinate with the relevant certification body throughout the preparation process. /p /li /ul /lilipClient security services: /pullipHelp define security service packages and tiers for inclusion in client proposals. /p /lilipComplete client security questionnaires and develop reusable responses. /p /lilipParticipate in selected client meetings and discussions, providing senior-level cybersecurity expertise. /p /li /ul /lilipTeam development and knowledge sharing: /pullipWork closely with the internal Security Lead, transferring knowledge and supporting their gradual ownership of daily security operations. /p /lilipOrganize internal workshops covering topics such as OWASP Top 10, threat modeling, and secure CI/CD practices. /p /lilipRecommend relevant training programs and certification pathways for developers, Security Champions, and DevOps engineers. /p /li /ul /li /ulh3Requirements: /h3pThe ideal candidate brings extensive cybersecurity experience and a strong technical background in application security, DevSecOps, and cloud security. This position requires someone who can independently implement security solutions while communicating effectively with both technical teams and management. The following qualifications are expected: /pullipAt least 8 years of professional experience in information security, including recent hands-on experience in application security, DevSecOps, or cloud security. /p /lilipProven ability to independently configure security tools, write pipeline configurations,



review source code, test applications, and develop security policies. /p /lilipPractical experience designing and implementing Secure Software Development Lifecycle processes and integrating security tools into CI/CD pipelines. /p /lilipStrong knowledge of cloud security across at least one major cloud platform: AWS, Azure, or Google Cloud Platform (GCP). /p /lilipExperience with Kubernetes and container security. /p /lilipUnderstanding of security risks associated with AI and Large Language Model (LLM)-based applications. /p /lilipAbility to communicate complex security concepts and risks clearly to both engineering teams and management. /p /lilipFluency in written and spoken English. /p /li /ulh3Additional Qualifications (Preferred): /h3ullipExperience with the EU Cyber Resilience Act (CRA), NIS2, and GDPR, particularly within software development, vendor, or supplier environments. /p /lilipExperience developing cybersecurity service offerings for clients in an agency, consulting, or outsourcing environment. /p /lilipPrevious experience implementing or auditing ISO/IEC 27001 or comparable frameworks such as SOC 2. /p /li /ulh3Preferred Certifications: /h3pOne or more of the following certifications would be an advantage: /pullipOffensive security and technical certifications: OSCP, BSCP, CDP, or CKS. /p /lilipISO/IEC 27001 Lead Implementer or Lead Auditor. /p /lilipCloud security certifications, such as AWS Security Specialty, AZ-500, or Google Professional Cloud Security Engineer. /p /lilipCISSP, CISM, or CSSLP. /p /li /ulh3Benefits /h3ullipFully remote working arrangement, with the flexibility to work from anywhere with a stable internet connection. /p /lilipPart-time position with flexible working hours and the freedom to choose your preferred time zone and schedule. /p /lilipNegotiable hourly compensation based on skills and professional experience. /p /lilipMonthly payments via wire transfer for contractors. /p /lilipPaid training and professional development opportunities. /p /lilipAccess to modern technologies and opportunities to work on innovative projects. /p /lilipConsistent workload with a steady flow of engaging and challenging assignments. /p /lilipAnnual compensation increases based on performance. /p /lilipOpportunity to collaborate with an international team of experienced professionals. /p /li /ulpbData Privacy Notice: /b By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time. /p #J-18808-Ljbffr

📌 Cybersecurity Consultant (Italia)
🏢 Jobgether
📍 Italia