Senior Cyber DevSecOps Consultant

Deloitte France

Kansas City (MO)

On-site

USD 105,000 - 208,000

Full time

3 days ago

Be an early applicant

Application generator

Stand out for this role — generate a tailored resume and cover letter in about a minute.

Get past ATS filters

Job summary

Deloitte & Touche LLP is seeking a Cyber Senior Consultant to join our Cloud Cyber Services team, focusing on DevSecOps and Secure SDLC. You will coordinate across assessments, design, implementation, testing, and delivery with client stakeholders. The role emphasizes security architecture, threat modeling, cloud security, and software supply chain controls.

It also includes mentoring junior practitioners and contributing to proposals, with travel up to 50%.

Qualifications

Bachelor's degree in Computer Science, Cybersecurity, Information Technology, Engineering, Information Systems, or a related field.
4+ years of professional experience in DevSecOps, Application Security, Secure SDLC, Cloud Security, cybersecurity engineering, software security, or cybersecurity consulting.
2+ years of hands‑on experience with DevSecOps, Application Security, Secure SDLC, or Secure‑by‑Design activities, including assessment, design, implementation, or security engineering.
1+ year of experience leading or independently owning a cybersecurity, DevSecOps, Application Security, or Secure SDLC project workstream.
2+ years of experience with CI/CD or modern software engineering environments, including experience with at least 3 of the following security capabilities: SAST, DAST, SCA, secrets scanning, IaC scanning, container security, API security, threat modeling, or vulnerability management.
1+ year of experience translating cybersecurity policies, standards, or control requirements into technical controls, engineering requirements, security procedures, or SDLC workflows.
Experience applying at least 1 cybersecurity framework or standard, such as NIST CSF, NIST SP 800‑53, NIST SSDF, OWASP SAMM, ISO 27001, or comparable framework, on at least 1 project.
1+ year of experience with at least 1 cloud or cloud-native environment, including Microsoft Azure, AWS, Google Cloud Platform, Kubernetes, or container‑based application environments.
1+ year of experience using at least 1 engineering, security workflow, or automation platform, such as ServiceNow, Jira, Azure DevOps, GitHub, GitLab, Jenkins, or comparable technology.
Ability to travel up to 50%, on average, based on the work you do and the clients and industries/sectors you serve.
Limited immigration sponsorship may be available.

Responsibilities

Execute DevSecOps and Secure SDLC workstreams across assessments, design, implementation, testing, and operationalization; coordinate with client stakeholders and delivery team members to complete assigned activities on time and with high quality.
Assess current-state security capabilities across people, processes, technology, and governance; analyze gaps and contribute to target-state recommendations, prioritized roadmaps, operating models, and implementation plans.
Design and implement Secure-by-Design and Application Security processes across the software development lifecycle, including application intake, risk classification, architecture reviews, threat modeling, control assessments, approvals, exception management, and go-live governance.
Support the integration of security tooling, automation, and AI-enabled capabilities into CI/CD and developer workflows, including SAST, DAST, SCA, secrets, infrastructure-as-code, container, API, and vulnerability management, as well as AI-assisted triage, remediation, validation, and secure AI guardrails.
Perform cloud-native and software supply chain security assessments, including cloud, container, Kubernetes, runtime, dependency, SBOM, artifact integrity, secure build, code-signing, secrets management, and software provenance activities; help define and prioritize remediation actions.
Contribute to client delivery and team development by facilitating workshops, preparing technical and executive deliverables, tracking work plans, risks, issues, and dependencies, supporting metrics and dashboards, mentoring junior practitioners, reviewing work for quality, and contributing to proposals and reusable practice assets.