Cybersecurity Consultant

Luminous Infoways; New Delhi; On-site; INR 1,500,000 - 2,100,000; Full time

Job summary

Luminous Infoways in Delhi seeks a skilled Cybersecurity Consultant to assess and strengthen the security of government IT systems, cloud infrastructure, and enterprise platforms. You will perform security audits, review VAPT findings, track remediation, and sign off before production go-live.

Responsibilities include defining audit scopes, assessing IAM and cloud baselines, coordinating with multi-disciplinary teams, and preparing formal security recommendations to reduce risk and ensure

Qualifications

• Bachelor’s degree in Computer Science, IT, Cybersecurity, or related discipline.
• Experience in cybersecurity consulting, security auditing, or IT risk assessment.
• Strong knowledge of risk management, vulnerabilities, and security controls.
• Experience reviewing VAPT reports and tracking remediation.
• Knowledge of cloud security, IAM, encryption, and incident response.
• Ability to prepare audit reports, checklists, and compliance documents.
• Strong communication and stakeholder coordination skills.

Responsibilities

• Define audit scope, objectives, and checklists for IT assets.
• Conduct security assessments of apps, APIs, databases, and cloud.
• Review configurations, access controls, and architecture for gaps.
• Maintain vulnerability registers and remediation tracking.
• Assess cloud baselines, IAM, MFA, and least privilege.
• Review incident response plans and readiness before go-live.
• Provide security recommendations and sign-off criteria.

Skills

Security auditing

VAPT reviews

Incident response

Risk assessment

Cloud security

Education

Bachelor’s degree in Computer Science, IT, Cybersecurity

Tools

Security assessment tools

Vulnerability management platforms

IAM

Job description

We are seeking a skilled Cybersecurity Consultant to assess, review, and strengthen the security posture of Government IT systems, cloud infrastructure, web applications, and enterprise platforms. The candidate will be responsible for conducting security audits, reviewing Vulnerability Assessment and Penetration Testing (VAPT) findings, tracking remediation activities, establishing cloud security baselines, assessing access controls, and ensuring incident response readiness. The role will also involve evaluating security risks and providing formal security recommendations and sign-off before production go-live.

Key Responsibilities

1. Security Audit & Compliance

Define security audit scope, objectives, assessment methodology, and audit checklists for IT applications and infrastructure.

Conduct security assessments of web applications, APIs, databases, servers, networks, and cloud environments.

Review security configurations, access permissions, system architecture, and operational controls.

Identify security gaps, vulnerabilities, compliance issues, and potential risks.

Prepare security audit reports with findings, severity classifications, recommendations, and corrective actions.

Verify alignment with applicable government security guidelines, organizational policies, and relevant industry standards.

Maintain audit evidence, risk registers, compliance records, and security review documentation.

2. VAPT Findings & Remediation Tracking

Review Vulnerability Assessment and Penetration Testing (VAPT) reports for applications, APIs, networks, and infrastructure.

Assess vulnerabilities based on severity, exploitability, business impact, and associated security risks.

Coordinate with development, infrastructure, cloud, and application teams to prioritize remediation activities.

Maintain vulnerability registers, remediation trackers, target closure dates, and escalation records.

Validate remediation evidence and coordinate retesting to confirm that identified vulnerabilities have been resolved.

Track unresolved critical and high-risk findings and escalate them to the appropriate stakeholders.

Provide recommendations for secure coding, configuration hardening, patch management, and vulnerability prevention.

3. Cloud Security Baseline & Access Control

Define and review cloud security baselines for platforms such as AWS, Microsoft Azure, or Google Cloud Platform (GCP).

Assess cloud configurations, network security, storage permissions, encryption, logging, and monitoring controls.

Review Identity and Access Management (IAM), role-based access control, privileged accounts, and least-privilege access.

Validate multi-factor authentication, access provisioning, account lifecycle management, and periodic access reviews.

Assess security controls for cloud-hosted applications, databases, APIs, virtual machines, and containerized workloads.

Review backup protection, disaster recovery arrangements, security logging, and alerting mechanisms.

Recommend corrective actions to address cloud misconfigurations, excessive permissions, and security control gaps.

4. Incident Response & Security Readiness

Assess incident response procedures, escalation matrices, communication protocols, and incident management workflows.

Review preparedness for cybersecurity incidents, including unauthorized access, malware, data breaches, and service disruptions.

Evaluate security monitoring, log management, alerting, evidence preservation, and incident reporting mechanisms.

Support the development and review of incident response plans, playbooks, and recovery procedures.

Coordinate incident response exercises, security awareness activities, and lessons-learned reviews.

Recommend measures to improve incident detection, containment, recovery, and business continuity.

Ensure security incidents and corrective actions are documented and tracked appropriately.

5. Application & Infrastructure Security Review

Review application architecture, APIs, authentication mechanisms, session management, and data protection controls.

Assess security risks associated with application integrations, databases, third-party services, and external interfaces.

Evaluate security configurations for servers, operating systems, firewalls, networks, and cloud infrastructure.

Review secure development practices and recommend controls to reduce application-level vulnerabilities.

Assess encryption, secrets management, audit logging, and sensitive data handling practices.

Coordinate with solution architects, developers, infrastructure teams, and QA teams to address identified security risks.

6. Go-Live Security Assessment & Sign-Off

Conduct security readiness assessments before production deployment of applications and IT systems.

Review security audit results, VAPT findings, remediation evidence, access controls, and cloud security configurations.

Verify closure of critical and high-risk vulnerabilities or ensure that formally approved risk exceptions are documented.

Assess incident response readiness, monitoring arrangements, backup controls, and security escalation procedures.

Document residual risks, outstanding actions, recommendations, and deployment conditions.

Provide formal security recommendations and sign-off based on the approved go-live security criteria.

Security audit scope, assessment methodology, and security audit checklist.

Application, infrastructure, API, and cloud security assessment reports.

VAPT findings register and vulnerability remediation tracker.

Remediation validation and retesting reports.

Cloud security baseline and access control review documentation.

Incident response readiness assessment and recommendations.

Security risk register, compliance evidence, and corrective action reports.

A Go-Live Security Sign-Off Note for each engagement, documenting the assessment scope, security findings, remediation status, residual risks, approved exceptions, and final security readiness recommendation.

Required Qualifications & Experience

Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related discipline.

Relevant professional experience in cybersecurity consulting, information security, security auditing, or IT risk assessment.

Strong understanding of information security principles, risk management, vulnerability assessment, and security controls.

Experience reviewing VAPT reports, tracking remediation activities, and validating security fixes.

Knowledge of cloud security, IAM, access control, encryption, network security, and infrastructure hardening.

Understanding of incident response processes, security monitoring, logging, and disaster recovery.

Experience preparing security audit reports, checklists, risk registers, and compliance documentation.

Strong analytical, problem-solving, documentation, and stakeholder coordination skills.

Preferred Skills & Certifications

Experience in Government IT, public sector, e-Governance, or large-scale enterprise technology projects.

Knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, CIS Benchmarks, and OWASP guidance.

Familiarity with security assessment tools and vulnerability management platforms.

Exposure to cloud security reviews across AWS, Microsoft Azure, or GCP.

Relevant certifications such as CISSP, CISA, CISM, CEH, Security+, or cloud security certifications will be an added advantage.

Understanding of applicable Indian cybersecurity requirements and government security guidelines.

Qualification - B.E./B.Tech./MCA/M.Tech. or equivalent in Engineering, Computer Science, IT, Management or a related discipline.