Cybersecurity Consultant (Application & Cloud)

Responsibilities

• Conduct cybersecurity risk assessments and security reviews of applications, IT systems, infrastructure, APIs, and cloud services.
• Review system architectures, data flows, interfaces, and security controls to identify potential vulnerabilities and risks.
• Apply application security best practices, including OWASP Top 10 and OWASP Application Security Verification Standard (ASVS).
• Perform source code security reviews using SAST tools such as Fortify on Demand and SonarQube.
• Support secure software development through Agile, CI/CD, and DevSecOps practices, including automated security testing.
• Conduct threat modelling to identify, assess, and mitigate application security risks.
• Track vulnerabilities, review remediation plans, and ensure timely patching and closure of identified security issues.
• Monitor and investigate cybersecurity alerts and incidents, supporting incident triage, containment, remediation, recovery, and post-incident reviews.
• Conduct security awareness training and promote good cybersecurity practices across the organisation.
• Collaborate with technical teams and stakeholders to improve security controls and ensure compliance with established requirements.

Requirements

• At least 5 years of combined experience in software development, application security, and cloud computing, such as AWS.
• Good understanding of mobile and web application architectures, APIs, REST, SOAP, and SSL/TLS.
• Strong knowledge of application security principles, vulnerability management, and industry best practices.
• Familiarity with CI/CD pipelines, DevSecOps tools, and platforms such as GitLab, GitHub, and Ansible.
• Experience using SAST tools such as Fortify on Demand or SonarQube.
• Strong analytical, problem-solving, troubleshooting, and communication skills, with the ability to work independently and collaborate with stakeholders.
• Degree in a relevant discipline or equivalent qualification.
• Relevant certifications such as CISSP, OSCP, CCSP, CRISC, or AWS security certifications are preferred.
• Experience with Government Commercial Cloud (GCC) is an advantage

Skills

Security Controls, Application Architecture, Certifications, Security Assessments, Application Security, Cloud Computing, Implementation of Best Practices, Web Application Security Assessment, scientific discipline, Patch Management, Source Code Reviews, Cybersecurity, Collaboration With Stakeholders, Agile Software Development, Sas Intelligence Platform, Platforms