Cybersecurity Consultant – Client Risk Assessments

Houston Skilled Consultancy; Singapore; Hybrid; SGD 90,000 - 150,000; Full time

Job summary

Houston Skilled Consultancy is recruiting a Cybersecurity Consultant – Client Risk Assessments to support organizations in identifying, evaluating, and mitigating cybersecurity risks across IT environments, business operations, and third‑party relationships.

You will conduct structured risk assessments, review security policies, and recommend practical controls aligned with ISO/IEC 27001 and NIST standards.

Qualifications

• 3–5 years of experience in cybersecurity risk assessments, security controls reviews, or equivalent consulting roles.
• Experience translating technical findings into business implications and remediation plans.
• Familiarity with ISO/IEC 27001, NIST, CIS Controls, and SOC 2 criteria is preferred.

Responsibilities

• Perform comprehensive client cybersecurity risk assessments across IT and business environments.
• Develop remediation plans and prioritize actions with client IT and security teams.
• Assess frameworks, policies, and controls to ensure audit readiness and regulatory alignment.
• Manage third‑party and vendor risk assessments and related questionnaires.
• Engage with clients and stakeholders to present findings and recommended actions.
• Document assessment results, risks, and mitigation tracks for ongoing improvement.

Skills

Analytical reasoning

Risk assessment methodology

Stakeholder communication

Client-focused service

Problem solving

Education

Bachelor's degree in Cybersecurity or related field

Tools

Vulnerability scanners

Risk assessment platforms

Documentation systems

Job description

1. Job Summary

Houston Skilled Consultancy is seeking a knowledgeable, analytical, and client-focused Cybersecurity Consultant – Client Risk Assessments to support organizations in identifying, evaluating, and mitigating cybersecurity risks across their IT environments, business operations, and third-party relationships. The successful candidate will work closely with clients to assess their cybersecurity posture, identify vulnerabilities, evaluate security controls, and recommend practical strategies to strengthen their overall risk management framework. This role involves conducting structured risk assessments, reviewing security policies and procedures, analyzing technical and operational risks, and helping clients align their security practices with recognized industry standards and regulatory requirements. The Cybersecurity Consultant will collaborate with IT teams, information security professionals, compliance specialists, business leaders, and external stakeholders to understand each client’s risk exposure and develop actionable remediation plans. The role requires a combination of technical cybersecurity knowledge, business risk awareness, communication skills, and the ability to translate complex security findings into clear recommendations for both technical and non-technical audiences. At Houston Skilled Consultancy, the successful candidate will contribute to improving client resilience, protecting sensitive information, strengthening security governance, and supporting informed business decisions through effective cybersecurity risk assessments.

2. Key Responsibilities

Client Cybersecurity Risk Assessments

• Conduct comprehensive cybersecurity risk assessments to identify potential threats, vulnerabilities, control weaknesses, and operational risks within client environments.
• Evaluate clients existing security measures, IT infrastructure, access controls, network security, endpoint protection, cloud configurations, and data protection practices.
• Review business processes and technology environments to determine potential cybersecurity exposure and the impact of identified risks.
• Gather relevant information through stakeholder interviews, technical documentation reviews, questionnaires, workshops, and evidence collection.
• Assess the likelihood and potential business impact of cybersecurity threats and classify risks according to established risk-rating methodologies.
• Prepare detailed assessment reports outlining identified risks, existing controls, security gaps, and recommended corrective actions.

Risk Mitigation and Remediation

• Develop practical risk mitigation strategies tailored to each client’s business requirements, technology environment, and risk tolerance.
• Work with client IT and security teams to prioritize remediation activities based on severity, business impact, and regulatory obligations.
• Recommend improvements to security policies, identity and access management, incident response procedures, vulnerability management, and data protection controls.
• Monitor remediation progress and assist clients in tracking outstanding security findings through completion.
• Support the development of risk registers, remediation roadmaps, action plans, and risk acceptance documentation.
• Provide guidance on reducing recurring security weaknesses and improving long-term cybersecurity maturity.

Security Frameworks and Compliance

• Assess client security practices against relevant frameworks and standards, such as ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, and applicable SOC 2 criteria.
• Support assessments involving data protection, privacy, information security governance, and relevant regulatory requirements.
• Review information security policies, procedures, standards, and control documentation to identify deficiencies.
• Assist clients in preparing for security audits, compliance reviews, customer security assessments, and third‑party risk evaluations.
• Maintain accurate documentation to support audit readiness, risk reporting, and management decision‑making.
• Stay informed about relevant cybersecurity standards, emerging threats, and changes in applicable regulatory expectations.

Third‑Party and Vendor Risk Management

• Evaluate cybersecurity risks associated with suppliers, service providers, technology partners, and other external organizations.
• Review vendor security questionnaires, independent assurance reports, security policies, and relevant contractual requirements.
• Identify potential risks arising from third‑party access to client systems, confidential information, and critical business services.
• Recommend appropriate vendor risk controls, monitoring processes, and remediation measures.
• Help clients establish consistent procedures for assessing and monitoring third‑party cybersecurity risks.

Client Engagement and Stakeholder Management

• Conduct client meetings, discovery sessions, and risk assessment workshops to understand business priorities and security concerns.
• Explain cybersecurity risks, assessment findings, and recommended actions in clear, practical business language.
• Present assessment results and risk summaries to client management, technical teams, and other relevant stakeholders.
• Build professional relationships with clients and maintain a strong focus on service quality, confidentiality, and timely delivery.
• Coordinate with internal consultants and subject matter experts to deliver consistent, high‑quality assessment outcomes.
• Manage multiple client engagements, assessment schedules, deliverables, and reporting deadlines.

Reporting and Continuous Improvement

• Prepare executive summaries, detailed technical findings, risk matrices, and management reports.
• Maintain reliable assessment records, supporting evidence, and documentation of agreed remediation activities.
• Track key risk indicators and identify patterns that may indicate broader security weaknesses.
• Recommend improvements to risk assessment methodologies, templates, procedures, and reporting practices.
• Contribute to internal knowledge‑sharing activities and the continuous improvement of cybersecurity consulting services.

3. Required Skills and Qualifications

Educational Qualifications

• Bachelors degree in Cybersecurity, Computer Science, Information Technology, Information Systems, Network Engineering, or a related discipline.
• Relevant postgraduate qualifications or specialized cybersecurity training will be an advantage.
• Equivalent professional experience and recognized industry certifications may be considered where appropriate.

Technical Skills

• Strong understanding of cybersecurity principles, information security controls, threat identification, and risk management methodologies.
• Knowledge of network security, operating systems, endpoint protection, identity and access management, and secure system administration.
• Familiarity with cloud security concepts across platforms such as Microsoft Azure, Amazon Web Services (AWS), or Google Cloud Platform.
• Understanding of vulnerability management, security monitoring, incident response, encryption, and data loss prevention.
• Ability to review security configurations, technical documentation, access permissions, and system architecture diagrams.
• Familiarity with security assessment tools, vulnerability scanners, risk management platforms, and documentation systems.
• Knowledge of business continuity, disaster recovery, and incident preparedness principles.
• Understanding of common cyber threats, including phishing, ransomware, credential compromise, insider threats, and third‑party security risks.

Risk Assessment and Analytical Skills

• Ability to identify, analyze, document, and prioritize cybersecurity risks.
• Experience applying structured risk assessment methods and evaluating the effectiveness of security controls.
• Strong problem‑solving skills and the ability to interpret technical findings in a business context.
• Ability to distinguish critical security issues from lower‑priority findings.
• Proficiency in developing risk registers, control gap assessments, mitigation plans, and management reports.

Communication and Client Service Skills

• Excellent written and verbal communication skills.
• Ability to explain complex cybersecurity concepts to non‑technical stakeholders.
• Strong presentation, interviewing, documentation, and stakeholder engagement abilities.
• Professional approach to client relationships, confidentiality, and sensitive business information.
• Ability to collaborate effectively with multidisciplinary teams and manage competing priorities.

Preferred Certifications

• Certified Information Systems Security Professional (CISSP).
• Certified Information Security Manager (CISM).
• Certified in Risk and Information Systems Control (CRISC).
• CompTIA Security+.
• Certified Information Systems Auditor (CISA).
• ISO/IEC 27001 Lead Implementer or Lead Auditor.
• Certified Cloud Security Professional (CCSP).
• Certifications are desirable rather than mandatory for every candidate, depending on the seniority and requirements of the position.

4. Experience

Typically, 3–5 years of relevant experience in cybersecurity, information security, IT risk management, security consulting, or a related field.

• Demonstrable experience conducting cybersecurity risk assessments, security control reviews, vulnerability assessments, or compliance gap analyses.
• Experience preparing risk assessment reports and presenting findings to clients or business stakeholders.
• Familiarity with established security frameworks, risk assessment methodologies, and remediation tracking processes.
• Experience working with IT infrastructure, cloud environments, enterprise applications, or information security governance is preferred.
• Previous experience in a consulting firm, managed security services provider, financial services organization, technology company, or regulated industry will be beneficial.
• Experience with third‑party risk assessments, vendor security reviews, or audit preparation is an advantage.
• Candidates with strong foundational cybersecurity knowledge and relevant practical experience may be considered for less senior opportunities, subject to the employer's requirements.

5. Working Hours

Employment Schedule: Full-time, subject to the agreed employment contract.

Typical Working Hours: Approximately 40 hours per week, depending on location and organizational policy.

Working Days: Generally Monday to Friday, subject to client requirements and the applicable employment arrangement.

Flexible Scheduling: Hybrid or remote working arrangements may be available for eligible positions.

Client Meetings: Occasional adjustments to working hours may be necessary to accommodate clients in different time zones.

Project Deadlines: Some flexibility may be required during major assessments, audit periods, or urgent client engagements.

The final working schedule, location, and employment terms will be confirmed by Houston Skilled Consultancy during the recruitment process.

6. Knowledge, Skills, and Abilities

Knowledge

• Knowledge of information security governance, cybersecurity risk management, and security control assessment.
• Understanding of confidentiality, integrity, and availability principles.
• Familiarity with security frameworks, audit requirements, and regulatory compliance considerations.
• Awareness of emerging cyber threats, attack techniques, and evolving security practices.
• Understanding of risk ownership, risk acceptance, remediation planning, and continuous monitoring.

Skills

• Analytical thinking and structured problem‑solving.
• Technical assessment and evidence evaluation.
• Clear report writing and professional presentation.
• Risk prioritization and remediation planning.
• Client relationship management and stakeholder communication.
• Project coordination, time management, and attention to detail.
• Ability to work effectively with security, infrastructure, compliance, and business teams.

Abilities

• Ability to assess complex technology environments and identify meaningful security risks.
• Ability to convert technical assessment results into actionable business recommendations.
• Ability to handle confidential information responsibly and follow established security procedures.
• Ability to manage multiple client assignments while maintaining accuracy and quality.
• Ability to work independently, exercise professional judgment, and elevate significant risks appropriately.
• Ability to adapt to changing client needs, emerging threats, and evolving compliance expectations.
• Ability to support a culture of accountability, security awareness, and continuous improvement.

7. Benefits

Houston Skilled Consultancy may offer a competitive benefits package based on the position, employment arrangement, work location, and applicable company policies.

• Competitive salary aligned with relevant experience, qualifications, and responsibilities.
• Opportunities for professional development and cybersecurity training.
• Support for relevant industry certifications, subject to company policy.
• Exposure to diverse client environments, security frameworks, and risk management challenges.
• Potential remote or hybrid working options for eligible roles.
• Opportunities to collaborate with experienced cybersecurity and technology professionals.
• Performance‑based recognition or incentives, where applicable.
• Paid leave and public holidays in accordance with the employment contract and applicable law.
• Opportunities to develop expertise in governance, risk, compliance, cloud security, and security consulting.
• Potential career progression into senior consulting, cybersecurity leadership, or enterprise risk management roles.
• Specific benefits, compensation, and eligibility will be communicated by the employer during the recruitment process. These benefits should not be considered guaranteed unless confirmed in the formal employment offer.

8. Why Join Houston Skilled Consultancy?

Joining Houston Skilled Consultancy as a Cybersecurity Consultant – Client Risk Assessments offers an opportunity to contribute to the protection of business systems, sensitive information, and critical technology environments.

Make a Meaningful Security Impact

• Help organizations understand their cybersecurity exposure, improve their security controls, and make informed decisions about protecting their digital assets.

Develop Your Consulting Expertise

• Build experience in client risk assessments, security governance, third‑party risk management, compliance reviews, and remediation planning.

Work on Diverse Security Challenges

• Gain exposure to different business environments, technology platforms, security requirements, and risk management priorities, depending on assigned projects.

Strengthen Professional Capabilities

• Develop your technical assessment, analytical, reporting, presentation, and stakeholder management skills through practical consulting assignments.

Build a Long-Term Career

• Pursue potential advancement into senior cybersecurity consultant, information security manager, GRC specialist, cybersecurity risk manager, or security advisory leadership positions.

Contribute to Continuous Improvement

• Help clients establish stronger security practices, improve risk visibility, and develop a proactive approach to cybersecurity.

Houston Skilled Consultancy seeks professionals who combine technical knowledge with sound judgment, integrity, and a commitment to delivering practical value to clients.