IT Security Consultant: Secure by Design (m/f/d)

CLOUDYRION; Düsseldorf; On-site; EUR 60,000 - 85,000; Full time

Benefits offered by this job

30 days of vacation

Hybrid work model

In-house gym and break spaces

Individual learning opportunities

Job summary

CLOUDYRION is seeking a Secure by Design Consultant in Düsseldorf. This role involves running threat modelling workshops and analyzing complex architectures. Candidates should have at least 3 years in cybersecurity, hands-on knowledge in cloud security, and experience producing actionable security plans. The position offers a hybrid work model, competitive vacation days, and opportunities for professional development. You will be part of an interdisciplinary team, contributing significantly to our practice areas.

Qualifications

• At least 3 years’ experience in cybersecurity.
• Solid hands-on knowledge in cloud security.
• Experience producing security plans that teams use.

Responsibilities

• Run threat modelling workshops with product teams.
• Analyze complex cloud and AI architectures.
• Integrate security tools into CI/CD pipelines.

Skills

Cybersecurity consulting experience

Cloud security (AWS / Azure / GCP)

Threat modelling

Application security

Rolls with infrastructure code

German (B2 or higher)

Risk assessment methods (ISO 27005, NIST 800‑30, etc.)

Cloud security certification

Education

Cloud security certification (AWS/Azure/GCP security specialty, or CCSP)

Tools

Kubernetes

Terraform

CI/CD security tooling

Job description

Right now, the wave of AI-ready cyber resilience and EU regulations (NIS2, DORA, EU CRA, EU AI Act) is reshaping how every large organisation in Europe approaches cybersecurity. Our Secure by Design practice is at the heart of this shift and takes it a step further: Compliance with regulatory requirements is a given for us, sustainable technical implementation is what we pride ourselves on: outcome-based rather than hour-based, knowledge-focused rather than leverage-focused, product-led rather than slide-led.

To continue meeting our clients’ needs whilst maintaining our quality standards, we are seeking experienced Secure by Design Consultants to help shape our scale.

THE ROLE

• You run threat modelling workshops together with product or platform teams and advise decision-makers strategically on Secure-by-Design.
• You analyze complex cloud, software and AI architectures, improve technical and organisational processes, and controls to derive measurable key risk indicators (KRIs).
• You contribute hands‑on by integrating security tools into CI/CD pipelines, optimizing Secure SDLC processes, and confidently working with infrastructure code when needed.
• You present and facilitate discussions confidently with both technical and non-technical stakeholders.
• You’re part of an interdisciplinary team and actively shape the development of our practice areas.

YOUR PROFILE

Must haves

• At least 3 years’ experience in cybersecurity, for example in consulting, cloud, or software engineering
• Practical experience running security risk assessments and producing security plans or concepts that engineering teams actually used
• Solid hands‑on knowledge in at least one of: cloud security (AWS / Azure / GCP), threat modelling, application security, CI/CD security tooling
• Confident in front of a client — running a workshop, presenting findings, writing for a CISO or product-owner audience
• Clear written and spoken English
• German at B2 or higher
• Familiarity with the EU Cyber Resilience Act (CRA) or EU AI Act
• Experience with a recognised risk‑assessment method (ISO 27005, NIST 800‑30, FAIR, BSI-Standard 200‑3)
• A cloud security certification (AWS / Azure / GCP security specialty, or CCSP)
• Kubernetes, Infrastructure as Code (Terraform), container security
• Open source contributions, a blog, talks or any portfolio of how you think

WHY CLOUDYRION

• We support EU Blue Card sponsorship and offer a relocation package for international hires
• 30 days of vacation plus additional days off on Christmas, New Year’s Eve, and your birthday
• Hybrid work with two remote days per week, trust‑based working hours and the opportunity of workations in any EU country
• Individual learning and development opportunities, including full coverage of advanced trainings, certification costs, and educational leave for exam days
• In‑house gym, massage chairs, gaming area, and dedicated break spaces
• Regular team events and plenty of space for real collaboration

You can find information on data protection during the application process at CLOUDYRION here.

Katharina - People & Culture