Cybersecurity Consultant

xebiacee; United States; Remote; USD 14,000 - 23,000; Full time

Job summary

xebiacee is seeking an information security professional to enhance security across engineering, IT, and compliance in an international organization. The role blends hands-on control delivery with asset visibility, identity and access management, vulnerability remediation, and clear documentation while coordinating across technical teams with autonomy over technical decisions.

The position is based in Bucharest, Romania, with on-site three days per week.

Qualifications

• Experience in information, IT, or product security in a complex technical environment.
• Hands-on security asset inventory management and vulnerability management, including scan coverage, prioritization, and remediation tracking.
• Practical experience with SAST and DAST and integrating security testing into delivery workflows.
• Working knowledge of API security, access control models such as RBAC, IAM, SSO, and least-privilege principles.
• Familiarity with frameworks such as ISO 27001, NIS2, or SOC 2.
• Strong technical writing and communication skills, a delivery-focused approach, and professional fluency in English.
• Experience using AI-powered assistants in software delivery; EU work eligibility and a valid work permit are required.

Responsibilities

• Secure CI/CD pipelines through least-privilege access, isolated build environments, security scanning, secrets controls, and protected release workflows.
• Strengthen software supply-chain controls with measures such as artifact signing, software bills of materials, dependency pinning, and trusted registries.
• Build and maintain an inventory of APIs, endpoints, and supporting infrastructure, documenting ownership, classification, exposure, and lifecycle.
• Define access matrices for people, service accounts, integrations, API clients, and automated jobs; apply least privilege and segregation of duties.
• Improve identity controls, including single sign-on where feasible, and onboard assets into vulnerability scanning.
• Coordinate risk-based vulnerability triage and remediation, and document controls, findings, and procedures in English.

Skills

Security engineering

IAM

Vulnerability mgmt

SAST/DAST

API security

RBAC

Tools

Okta

Microsoft Entra ID

Qualys

GitHub Security

AWS

Job description

Role overview

Improve information security across engineering, IT, and compliance functions in an international organization. The work combines hands‑on security control delivery with asset visibility, identity and access management, vulnerability remediation, and clear documentation. You’ll coordinate across technical teams and stakeholders, with autonomy over technical decisions.

Responsibilities

• Secure CI/CD pipelines through least‑privilege access, isolated build environments, security scanning, secrets controls, and protected release workflows.
• Strengthen software supply‑chain controls with measures such as artifact signing, software bills of materials, dependency pinning, and trusted registries.
• Build and maintain an inventory of APIs, endpoints, and supporting infrastructure, documenting ownership, classification, exposure, and lifecycle.
• Define access matrices for people, service accounts, integrations, API clients, and automated jobs; apply least privilege and segregation of duties.
• Improve identity controls, including single sign‑on where feasible, and onboard assets into vulnerability scanning.
• Coordinate risk‑based vulnerability triage and remediation, and document controls, findings, and procedures in English.

Requirements

• Experience in information, IT, or product security in a complex technical environment.
• Hands‑on security asset inventory management and vulnerability management, including scan coverage, prioritization, and remediation tracking.
• Practical experience with SAST and DAST and integrating security testing into delivery workflows.
• Working knowledge of API security, access control models such as RBAC, IAM, SSO, and least‑privilege principles.
• Familiarity with frameworks such as ISO 27001, NIS2, or SOC 2.
• Strong technical writing and communication skills, a delivery‑focused approach, and professional fluency in English.
• Experience using AI‑powered assistants in software delivery; EU work eligibility and a valid work permit are required.

Nice to have

• AWS, GitHub security, Qualys, or identity platforms such as Okta or Microsoft Entra ID.
• Software supply‑chain security experience, including SBOMs and artifact signing.
• Experience working across product and engineering teams in an international organization.

Benefits and work setup

The position is based in Bucharest, Romania, with three days per week on-site.