Cybersecurity Consultant

Scopic; United States; Remote; USD 83,000 - 165,000; Part time

Benefits offered by this job

Paid training

Flexible remote work

Travel opportunities

Annual pay increases

Job summary

Scopic is seeking a senior security professional for a remote, hourly position. You’ll work hands-on across security governance, secure software development, compliance, and client security offerings, partnering with engineers to harden pipelines and cloud accounts.

You’ll implement a Secure SDLC based on OWASP, configure SSO/MFA, manage risk, and lead incident response exercises while mentoring the team and advancing ISO/IEC 27001 readiness. Fluency in English required.

Qualifications

• 8+ years of information security experience with hands-on app security, DevSecOps or cloud security.
• Hands-on experience configuring security tools, pipelines, reviewing code, and writing policies.
• Strong cloud security knowledge across AWS/Azure/GCP.
• Ability to explain security risks in plain language to engineers and management.
• Fluent English, both written and spoken.
• Kubernetes and container security experience.
• Knowledge of security risks in AI and LLM-based applications.

Responsibilities

• Run security maturity assessments (e.g., OWASP SAMM) and draft a prioritized roadmap.
• Write core security policies and procedures: access control, acceptable use, secure development, incident response.
• Maintain security backlog, risk register, and progress metrics; report monthly.
• Configure and enforce SSO and MFA across email, Git hosting, cloud consoles, CI/CD and Passbolt.
• Review access rights and onboarding/offboarding checklists.
• Harden Passbolt and set up a secrets manager; migrate secrets from code/CI vars.
• Baseline hardening for laptops, cloud accounts, backups and logging.
• Write the incident response plan and run tabletop exercises with the team.
• Build Secure SDLC based on OWASP ASVS/SAMM and roll out on client projects.
• Tune SecOps platform; reduce False positives; set up quality gates and triage findings.
• Add SAST, SCA, secrets scanning, IaC/container scanning, DAST, SBOM generation.
• Run threat modeling sessions and document results.
• Do security code reviews and help developers fix vulnerabilities.
• Perform internal security testing and coordinate external penetration tests.
• Map CRA, NIS2 and GDPR implications for us and clients.
• Write and implement vulnerability handling and disclosure processes.
• Assist in ISO/IEC 27001 preparation with certification body.
• Help define security service offerings for clients; fill client security questionnaires.
• Join client meetings as senior security voice when needed.
• Collaborate with Security Lead; run internal workshops; suggest training paths.

Skills

Fluent English

Kubernetes security

Container security

Cloud security

DevSecOps

Application security

Security policy writing

Job description

Job Description

Begin a career with one of the world’s largest virtual companies where you have flexibility and space to grow, just as we have been able to thanks to our team. Use the latest tools and technology to produce your best work and enjoy remuneration that’s reflective of your skills and experience.

This is a remote position.

This is a hands‑on role. We are not looking for someone to only advise us and leave the work to our team: you will do a large part of the security work yourself, working inside our repositories, pipelines and cloud accounts alongside our engineers. You will configure tools, fix and harden things, write the processes and documents, and run the sessions, while showing our team how it is done along the way.

Our goal is a company that runs a secure development lifecycle on every project, has its own house in order, is well on the way to ISO/IEC 27001 certification, and has an internal Security Lead who can work with you and gradually take over day‑to‑day ownership. This is a part‑time role.

Responsibilities

Assessment and governance

• Run the security maturity assessment yourself (for example OWASP SAMM), review our repositories, pipelines and cloud setup, and turn the findings into a prioritized roadmap.
• Write our core security policies and procedures: access control, acceptable use, secure development, incident response, vendor and AI tool usage.
• Set up and maintain the security backlog, risk register and progress metrics, and report progress to management monthly.

Company security (“secure the house”)

• Configure and enforce SSO and MFA across email, Git hosting, cloud consoles, CI/CD and Passbolt.
• Review and fix access rights, and set up onboarding and offboarding checklists.
• Harden our Passbolt setup and implement a secrets manager for applications and pipelines, including migrating existing secrets out of code and CI variables.
• Implement baseline hardening for laptops, cloud accounts, backups and logging.
• Write the incident response plan and run tabletop exercises with the team.

Secure software development

• Build our standard Secure SDLC, based on OWASP ASVS and OWASP SAMM, and roll it out on real client projects.
• Configure and tune our SecOps platform: reduce false positives, set up pipeline quality gates and triage findings together with the teams.
• Add the missing scanning to our CI/CD pipelines yourself: SAST, SCA, secrets scanning, IaC and container scanning, DAST and SBOM generation.
• Run threat modeling sessions on active projects and document the results.
• Do security code reviews of high‑risk changes and help developers fix vulnerabilities.
• Perform internal security testing of our applications before releases, and scope and coordinate external penetration tests.

Regulation and compliance

• Map how the EU Cyber Resilience Act (CRA), NIS2 and relevant local regulations affect us and our clients.
• Write and implement our vulnerability handling and disclosure process, including support for clients’ CRA reporting obligations.
• Do the hands‑on ISO/IEC 27001 preparation work: scope, risk assessment, Statement of Applicability, policies and evidence, and work with the certification body.

Client offering

• Help define security service tiers we can include in client proposals.
• Fill in client security questionnaires and build a reusable answer set.
• Join selected client meetings or calls as a senior security voice when needed.

People and knowledge

• Work side by side with our internal Security Lead so they learn by doing.
• Run short internal workshops on key topics (for example OWASP Top 10, threat modeling, secure CI/CD).
• Recommend training and certification paths for developers, Security Champions and DevOps engineers.

Requirements

Must have

• 8+ years of experience in information security, with recent hands‑on work in application security, DevSecOps or cloud security.
• Comfortable doing the work yourself: configuring security tools, writing pipeline configuration, reviewing code, testing applications and writing policies.
• Practical experience setting up a secure development lifecycle and integrating security tools into CI/CD pipelines.
• Good knowledge of cloud security in at least one major cloud (AWS, Azure or GCP).
• Ability to explain security risks in plain language to both engineers and management.
• Fluent English, written and spoken.
• Kubernetes and container security experience.
• Knowledge of security risks in AI and LLM‑based applications.

Nice to have

• Experience with the EU Cyber Resilience Act, NIS2 and GDPR in a software vendor or supplier context.
• Experience building security offerings for clients in an agency or outsourcing environment.
• Experience implementing or auditing ISO/IEC 27001 (or a comparable framework such as SOC 2).

Certifications (one or more preferred)

• Hands‑on certifications such as OSCP, BSCP, CDP or CKS
• ISO/IEC 27001 Lead Implementer or Lead Auditor
• Cloud security certification (AWS Security Specialty, AZ-500 or Google Professional Cloud Security Engineer)
• CISSP, CISM or CSSLP

The Secret Ingredients That Make Us Special:

• Your growth is our growth. We invest in your future with paid training and other professional opportunities.
• We’re industry innovators at the forefront of change. Equipped with the latest technologies and a team of knowledgeable colleagues by your side, you’ll embrace new and interesting challenges.
• Your location. Your schedule. Pick your time zone, choose your preferred hours, and work from the place where you feel most at home.
• Flexibility and freedom are in our DNA! As long as you have a stable internet connection and the drive to thrive, you can travel and work from anywhere you like.
• A workload you can rely on. We’ll set you enough tasks to keep that mind busy! At Scopic, we’ll ensure you always have a consistent flow of engaging, challenging work to do.
• Recognition and reward. We acknowledge diligence and hard work through annual pay increases for good performance.

Down to Business!

Your starting rate is negotiable depending on your skills and experience.

This is an hourly paid position.

Contractors are paid monthly via wire transfer.

Our Values:

Scopic is an equal‑opportunity employer. We value diversity and do not discriminate on the basis of race, religion, color, marital status, national origin, gender, veteran status, sexual orientation, age, or disability status.

Have the skills, the drive, and the passion to join the Scopic family?