Cybersecurity Consultant (Application & Cloud)

Responsibilities • Conduct cybersecurity risk assessments and security reviews of applications, IT systems, infrastructure, APIs, and cloud services. • Review system architectures, data flows, interfaces, and security controls to identify potential vulnerabilities and risks. • Apply application security best practices, including OWASP Top 10 and OWASP Application Security Verification Standard (ASVS). • Perform source code security reviews using SAST tools such as Fortify on Demand and SonarQube. • Support secure software development through Agile, CI/CD, and DevSecOps practices, including automated security testing. • Conduct threat modelling to identify, assess, and mitigate application security risks. • Track vulnerabilities, review remediation plans, and ensure timely patching and closure of identified security issues. • Monitor and investigate cybersecurity alerts and incidents, supporting incident triage, containment, remediation, recovery, and post-incident reviews. • Conduct security awareness training and promote good cybersecurity practices across the organisation. • Collaborate with technical teams and stakeholders to improve security controls and ensure compliance with established requirements. Requirements • At least 5 years of combined experience in software development, application security, and cloud computing, such as AWS. • Good understanding of mobile and web application architectures, APIs, REST, SOAP, and SSL/TLS. • Strong knowledge of application security principles, vulnerability management, and industry best practices. • Familiarity with CI/CD pipelines, DevSecOps tools, and platforms such as GitLab, GitHub, and Ansible. • Experience using SAST tools such as Fortify on Demand or SonarQube. • Strong analytical, problem-solving, troubleshooting, and communication skills, with the ability to work independently and collaborate with stakeholders. • Degree in a relevant discipline or equivalent qualification. • Relevant certifications such as CISSP, OSCP, CCSP, CRISC, or AWS security certifications are preferred. • Experience with Government Commercial Cloud (GCC) is an advantage