Position Summary:
- The Cybersecurity Expert will be responsible for implementing, maintaining, and auditing the organization’s information security framework, with a strong focus on ISO/IEC 27001 compliance. This role ensures that the company’s data and systems are secure from threats, and operates within the required legal and regulatory guidelines.
Key Responsibilities:
• Implement and maintain the ISO/IEC 27001 Information Security Management System (ISMS).
• Conduct risk assessments and develop mitigation strategies for cyber threats and vulnerabilities.
• Ensure continuous improvement of information security policies, procedures, and controls.
• Perform internal audits and prepare the organization for external ISO 27001 audits and certifications.
• Manage and resolve cybersecurity incidents, coordinating response plans and investigations.
• Provide guidance on secure development practices and secure system architecture.
• Train employees and departments on information security awareness and best practices.
• Collaborate with IT, legal, and compliance teams to ensure security is embedded across operations.
• Monitor security tools, log data, and system alerts to detect and respond to anomalies.
Penetration Testing
• Conduct application, API, mobile, network, and cloud penetration tests on internal and client systems.
• Simulate real-world attack scenarios to uncover exploitable vulnerabilities.
• Develop custom scripts, payloads, or tools to support advanced testing needs.
• Document findings with clear proof-of-concepts (PoCs) and technical impact analysis.
Vulnerability Assessment & Management
• Perform ongoing vulnerability scanning using industry-standard tools (e.g., Nessus, Qualys, OpenVAS, Burp Suite).
• Analyze scan results, validate findings, and prioritize remediation based on risk levels.
• Track remediation progress and provide guidance to development and DevOps teams.
• Maintain a continuous vulnerability management lifecycle including discovery, analysis, reporting, and verification.
Security Review & Advisory
• Collaborate with software development and DevOps teams to conduct secure code reviews and architecture assessments.
• Provide recommendations for secure design, configuration, and coding practices.
• Support clients by explaining vulnerabilities, associated risks, and mitigation strategies in clear, understandable language.
Monitoring & Threat Intelligence
• Monitor emerging threats, exploits, and security best practices to keep assessment methodologies up to date.
• Integrate threat intelligence into testing strategies to mimic current attacker techniques (TTPs).
Documentation & Reporting
• Prepare detailed penetration test reports, executive summaries, and risk-based recommendations.
• Maintain accurate records of assessments, testing plans, methodologies, and remediation efforts.
• Present findings to both technical and non-technical stakeholders, internal and external.
Requirements:
• 5+ years of experience in a cybersecurity role, with hands-on ISO 27001 implementation and auditing.
• Certified ISO/IEC 27001 Lead Implementer or Auditor (mandatory).
• Strong understanding of risk assessment, GRC frameworks, and security operations.
• Proficient in tools and technologies such as SIEM, IDS/IPS, vulnerability scanners, and endpoint protection.
• Excellent documentation and reporting skills.
• Bachelor’s degree in Cybersecurity, IT, or a related field; relevant certifications (CISSP, CISA, etc.) preferred.
Originally posted on