{"id":4152904,"url":"https://alion.io/job/scopic-remote-cybersecurity-consultant","title":"Remote Cybersecurity Consultant","company":{"id":4537698,"name":"Scopic","domain":null,"url":"https://alion.io/company/scopic-2","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":null,"truth_index":null},"role":"Security","role_family":"Security","seniority":null,"employment_type":"part_time","work_mode":"remote","remote_scope":"unspecified","remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"inferred","locations":[],"countries":[],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"Git","optional":false},{"name":"Kubernetes","optional":false},{"name":"LLM","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP ASVS","optional":false},{"name":"OWASP SAMM","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"SBOM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"GDPR","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-11-12T08:24:19Z","employer_posted_date":null,"last_verified_at":"2026-11-12T08:24:19Z","board_verified":false,"closed_at":null,"days_open":2,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":2},"description":"Category: IT Services \n\nLocation: \n\nThis is a hands-on role. We are not looking for someone to only advise us and leave the work to our team: you will do a large part of the security work yourself, working inside our repositories, pipelines and cloud accounts alongside our engineers. You will configure tools, fix and harden things, write the processes and documents, and run the sessions, while showing our team how it is done along the way.\n\nOur goal is a company that runs a secure development lifecycle on every project, has its own house in order, is well on the way to ISO/IEC 27001 certification, and has an internal Security Lead who can work with you and gradually take over day-to-day ownership. This is a part-time role.\n\nResponsibilities\nAssessment and governance\n\nRun the security maturity assessment yourself (for example OWASP SAMM), review our repositories, pipelines and cloud setup, and turn the findings into a prioritized roadmap.\n\nWrite our core security policies and procedures: access control, acceptable use, secure development, incident response, vendor and AI tool usage.\n\nSet up and maintain the security backlog, risk register and progress metrics, and report progress to management monthly.\n\nCompany security (\"secure the house\")\n\nConfigure and enforce SSO and MFA across email, Git hosting, cloud consoles, CI/CD and Passbolt.\n\nReview and fix access rights, and set up onboarding and offboarding checklists.\n\nHarden our Passbolt setup and implement a secrets manager for applications and pipelines, including migrating existing secrets out of code and CI variables.\n\nImplement baseline hardening for laptops, cloud accounts, backups and logging.\n\nWrite the incident response plan and run tabletop exercises with the team.\n\nSecure software development\n\nBuild our standard Secure SDLC, based on OWASP ASVS and OWASP SAMM, and roll it out on real client projects.\n\nConfigure and tune our SecOps platform: reduce false positives, set up pipeline quality gates and triage findings together with the teams.\n\nAdd the missing scanning to our CI/CD pipelines yourself: SAST, SCA, secrets scanning, IaC and container scanning, DAST and SBOM generation.\n\nRun threat modeling sessions on active projects and document the results.\n\nDo security code reviews of high-risk changes and help developers fix vulnerabilities.\n\nPerform internal security testing of our applications before releases, and scope and coordinate external penetration tests.\n\nRegulation and compliance\n\nMap how the EU Cyber Resilience Act (CRA), NIS2 and relevant local regulations affect us and our clients.\n\nWrite and implement our vulnerability handling and disclosure process, including support for clients' CRA reporting obligations.\n\nDo the hands-on ISO/IEC 27001 preparation work: scope, risk assessment, Statement of Applicability, policies and evidence, and work with the certification body.\n\nClient offering\n\nHelp define security service tiers we can include in client proposals.\n\nFill in client security questionnaires and build a reusable answer set.\n\nJoin selected client meetings or calls as a senior security voice when needed.\n\nPeople and knowledge\n\nWork side by side with our internal Security Lead so they learn by doing.\n\nRun short internal workshops on key topics (for example OWASP Top 10, threat modeling, secure CI/CD).\n\nRecommend training and certification paths for developers, Security Champions and DevOps engineers.\n\nRequirements\n\nMust have\n\n8+ years of experience in information security, with recent hands-on work in application security, DevSecOps or cloud security.\n\nComfortable doing the work yourself: configuring security tools, writing pipeline configuration, reviewing code, testing applications and writing policies.\n\nPractical experience setting up a secure development lifecycle and integrating security tools into CI/CD pipelines.\n\nGood knowledge of cloud security in at least one major cloud (AWS, Azure or GCP).\n\nAbility to explain security risks in plain language to both engineers and management.\n\nFluent English, written and spoken.\n\nKubernetes and container security experience.\n\nKnowledge of security risks in AI and LLM-based applications.\n\nNice to have\n\nExperience with the EU Cyber Resilience Act, NIS2 and GDPR in a software vendor or supplier context.\n\nExperience building security offerings for clients in an agency or outsourcing environment.\n\nExperience implementing or auditing ISO/IEC 27001 (or a comparable framework such as SOC 2).\n\nCertifications (one or more preferred)\n\nHands-on certifications such as OSCP, BSCP, CDP or CKS\n\nISO/IEC 27001 Lead Implementer or Lead Auditor\n\nCloud security certification (AWS Security Specialty, AZ-500 or Google Professional Cloud Security Engineer)\n\nCISSP, CISM or CSSLP\n\nThe Secret Ingredients That Make Us Special:\n\nYour growth is our growth. We invest in your future with paid training and other professional opportunities. \n\nWe're industry innovators at the forefront of change. Equipped with the latest technologies and a team of knowledgeable colleagues by your side, you'll embrace new and interesting challenges. \n\nYour location. Your schedule. Pick your time zone, choose your preferred hours, and work from the place where you feel most at home. \n\nFlexibility and freedom are in our DNA! As long as you have a stable internet connection and the drive to thrive, you can travel and work from anywhere you like. \n\nA workload you can rely on. We'll set you enough tasks to keep that mind busy! At Scopic, we'll ensure you always have a consistent flow of engaging, challenging work to do. \n\nRecognition and reward. We acknowledge diligence and hard work through annual pay increases for good performance. \n\nDown to Business!\n\nYour starting rate is negotiable depending on your skills and experience. \n\nThis is an hourly paid position. \n\nContractors are paid monthly via wire transfer. \n\nOur Values:\nScopic is an equal-opportunity employer. We value diversity and do not discriminate on the basis of race, religion, color, marital status, national origin, gender, veteran status, sexual orientation, age, or disability status. \n\nHave the skills, the drive, and the passion to join the Scopic family? Apply today to join our growing team of remote professionals from around the world. \n\nTerms of Application\n\nBy submitting an application:\n\nI consent that the data provided in this form, and the attached CV, will be used for Scopic's recruiting purposes and email communications. \n\nI consent to Scopic conducting an identity verification process as part of the hiring process. I understand that my personal information may be collected and processed for the purpose of verifying my identity in compliance with applicable laws. \n\nDetailsOriginally posted on Himalayas","description_format":"text","description_chars":6755,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Application Security"],"lifecycle":[{"event":"open","at":"2026-11-12T09:54:05Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":1,"expected_fill_days":28,"reasons":["seen:1","win:early"],"computed_at":"2026-11-14T05:58:10Z"},"pay":null,"html_url":"https://alion.io/job/scopic-remote-cybersecurity-consultant","json_url":"https://alion.io/job/scopic-remote-cybersecurity-consultant.json","meta":{"generated_at":"2026-11-14T17:44:36Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":20681,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-15T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4537698},"rest":"https://alion.io/mcp/rest/get_company?id=4537698"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fscopic-remote-cybersecurity-consultant"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fscopic-remote-cybersecurity-consultant"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fscopic-remote-cybersecurity-consultant"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/scopic-remote-cybersecurity-consultant\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fscopic-remote-cybersecurity-consultant"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4152904}},{"tool":"search_jobs","arguments":{"company":4537698,"detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4152904},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}