Cybersecurity Consultant

Location - New Delhi Experience - 8-10Years+

Vacancies - 1

Job Summary

We are seeking a skilled Cybersecurity Consultant to assess, review, and strengthen the security posture of Government IT systems, cloud infrastructure, web applications, and enterprise platforms. The candidate will be responsible for conducting security audits, reviewing Vulnerability Assessment and Penetration Testing (VAPT) findings, tracking remediation activities, establishing cloud security baselines, assessing access controls, and ensuring incident response readiness. The role will also involve evaluating security risks and providing formal security recommendations and sign-off before production go-live.

Key Responsibilities

1. Security Audit & Compliance

• Define security audit scope, objectives, assessment methodology, and audit checklists for IT applications and infrastructure.
• Conduct security assessments of web applications, APIs, databases, servers, networks, and cloud environments.
• Review security configurations, access permissions, system architecture, and operational controls.
• Identify security gaps, vulnerabilities, compliance issues, and potential risks.
• Prepare security audit reports with findings, severity classifications, recommendations, and corrective actions.
• Verify alignment with applicable government security guidelines, organizational policies, and relevant industry standards.
• Maintain audit evidence, risk registers, compliance records, and security review documentation.

2. VAPT Findings & Remediation Tracking

• Review Vulnerability Assessment and Penetration Testing (VAPT) reports for applications, APIs, networks, and infrastructure.
• Assess vulnerabilities based on severity, exploitability, business impact, and associated security risks.
• Coordinate with development, infrastructure, cloud, and application teams to prioritize remediation activities.
• Maintain vulnerability registers, remediation trackers, target closure dates, and escalation records.
• Validate remediation evidence and coordinate retesting to confirm that identified vulnerabilities have been resolved.
• Track unresolved critical and high-risk findings and escalate them to the appropriate stakeholders.
• Provide recommendations for secure coding, configuration hardening, patch management, and vulnerability prevention.

3. Cloud Security Baseline & Access Control

• Define and review cloud security baselines for platforms such as AWS, Microsoft Azure, or Google Cloud Platform (GCP).
• Assess cloud configurations, network security, storage permissions, encryption, logging, and monitoring controls.
• Review Identity and Access Management (IAM), role-based access control, privileged accounts, and least-privilege access.
• Validate multi-factor authentication, access provisioning, account lifecycle management, and periodic access reviews.
• Assess security controls for cloud-hosted applications, databases, APIs, virtual machines, and containerized workloads.
• Review backup protection, disaster recovery arrangements, security logging, and alerting mechanisms.
• Recommend corrective actions to address cloud misconfigurations, excessive permissions, and security control gaps.

4. Incident Response & Security Readiness

• Assess incident response procedures, escalation matrices, communication protocols, and incident management workflows.
• Review preparedness for cybersecurity incidents, including unauthorized access, malware, data breaches, and service disruptions.
• Evaluate security monitoring, log management, alerting, evidence preservation, and incident reporting mechanisms.
• Support the development and review of incident response plans, playbooks, and recovery procedures.
• Coordinate incident response exercises, security awareness activities, and lessons-learned reviews.
• Recommend measures to improve incident detection, containment, recovery, and business continuity.
• Ensure security incidents and corrective actions are documented and tracked appropriately.

5. Application & Infrastructure Security Review

• Review application architecture, APIs, authentication mechanisms, session management, and data protection controls.
• Assess security risks associated with application integrations, databases, third-party services, and external interfaces.
• Evaluate security configurations for servers, operating systems, firewalls, networks, and cloud infrastructure.
• Review secure development practices and recommend controls to reduce application-level vulnerabilities.
• Assess encryption, secrets management, audit logging, and sensitive data handling practices.
• Coordinate with solution architects, developers, infrastructure teams, and QA teams to address identified security risks.

6. Go-Live Security Assessment & Sign-Off

• Conduct security readiness assessments before production deployment of applications and IT systems.
• Review security audit results, VAPT findings, remediation evidence, access controls, and cloud security configurations.
• Verify closure of critical and high-risk vulnerabilities or ensure that formally approved risk exceptions are documented.
• Assess incident response readiness, monitoring arrangements, backup controls, and security escalation procedures.
• Document residual risks, outstanding actions, recommendations, and deployment conditions.
• Provide formal security recommendations and sign-off based on the approved go-live security criteria.

Key Deliverables

• Security audit scope, assessment methodology, and security audit checklist.
• Application, infrastructure, API, and cloud security assessment reports.
• VAPT findings register and vulnerability remediation tracker.
• Remediation validation and retesting reports.
• Cloud security baseline and access control review documentation.
• Incident response readiness assessment and recommendations.
• Security risk register, compliance evidence, and corrective action reports.
• A Go-Live Security Sign-Off Note for each engagement, documenting the assessment scope, security findings, remediation status, residual risks, approved exceptions, and final security readiness recommendation.

Required Qualifications & Experience

• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Engineering, or a related discipline.
• Relevant professional experience in cybersecurity consulting, information security, security auditing, or IT risk assessment.
• Strong understanding of information security principles, risk management, vulnerability assessment, and security controls.
• Experience reviewing VAPT reports, tracking remediation activities, and validating security fixes.
• Knowledge of cloud security, IAM, access control, encryption, network security, and infrastructure hardening.
• Understanding of incident response processes, security monitoring, logging, and disaster recovery.
• Experience preparing security audit reports, checklists, risk registers, and compliance documentation.
• Strong analytical, problem-solving, documentation, and stakeholder coordination skills.

Preferred Skills & Certifications

• Experience in Government IT, public sector, e-Governance, or large-scale enterprise technology projects.
• Knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, CIS Benchmarks, and OWASP guidance.
• Familiarity with security assessment tools and vulnerability management platforms.
• Exposure to cloud security reviews across AWS, Microsoft Azure, or GCP.
• Relevant certifications such as CISSP, CISA, CISM, CEH, Security+, or cloud security certifications will be an added advantage.
• Understanding of applicable Indian cybersecurity requirements and government security guidelines.

Qualification - B.E./B.Tech./MCA/M.Tech. or equivalent in Engineering, Computer Science, IT, Management or a related discipline.