Security Consultant

• Perform comprehensive security assessments across infrastructure, systems, applications, networks, and cloud environments.
• Maintain accurate asset inventories, identify security gaps, classify critical assets, and ensure appropriate security controls are applied.
• Lead vulnerability assessments, analyze findings, prioritize risks based on severity and business impact, and track remediation through closure.
• Conduct threat assessments and remediation analysis to identify attack vectors, security weaknesses, and potential business impacts.
• Develop and recommend remediation strategies for vulnerabilities, misconfigurations, and security control deficiencies.
• Support infrastructure and operations security, including servers, networks, endpoints, cloud platforms, identity/access controls, and security technologies.
• Evaluate proposed infrastructure and system changes for security risks and ensure appropriate change management and security controls are followed.
• Participate in security architecture and design reviews to ensure solutions meet organizational security standards.
• Monitor security risks and collaborate with infrastructure, application, cloud, DevOps, and operations teams to resolve security issues.
• Develop security risk reports, assessment findings, remediation plans, and executive-level summaries.
• Establish and maintain security policies, standards, procedures, and control requirements.
• Support security audits, compliance assessments, risk reviews, and regulatory requirements.
• Coordinate with incident response teams when vulnerabilities or threats require immediate investigation or remediation.
• Track security metrics, remediation SLAs, risk acceptance, and recurring vulnerabilities.
• Provide security guidance and recommendations to technical teams and business stakeholders.

• Vulnerability management and risk assessment
• Threat modeling and threat assessment
• Infrastructure and network security
• Cloud security across Azure, AWS, or Google Cloud Platform
• Security configuration and hardening
• Identity and Access Management (IAM)
• Endpoint and server security
• SIEM and security monitoring concepts
• Security incident response
• Patch and remediation management
• Security policies, standards, and controls
• Risk management and security governance
• ITIL / change management processes
• Security frameworks such as NIST CSF, NIST 800-53, CIS Controls, ISO 27001, and OWASP

Preferred Tools

• Vulnerability: Tenable/Nessus, Qualys, Rapid7
• SIEM: Splunk, Microsoft Sentinel, QRadar
• Cloud Security: Microsoft Defender, AWS Security Hub, Wiz, Prisma Cloud
• Ticketing/Change: ServiceNow, Jira
• Endpoint: CrowdStrike, Microsoft Defender for Endpoint
• Network Security: Palo Alto, Fortinet, Cisco security technologies

Preferred Certifications

• CISSP
• CISM
• Security+
• CEH
• CRISC
• GIAC certifications
• Cloud security certifications such as AZ-500, AWS Security Specialty, or Google Professional Cloud Security Engineer, * Strong analytical and problem-solving skills
• Ability to translate technical vulnerabilities into business risk
• Strong communication with technical and non-technical stakeholders
• Experience managing remediation across multiple teams
• Ability to prioritize security risks based on severity and business impact
• Strong documentation, reporting, and security governance skills