Cyber Security Specialist

About the role

A Cyber Security Specialist is sought to take ownership of application, cloud and infrastructure security across the platform. The role works closely with the development team to identify vulnerabilities, implement security controls and prepare the platform for security assessments and compliance requirements.

Key responsibilities

• Conduct security reviews of the application, APIs and infrastructure, and perform threat modelling and security reviews for new features.
• Identify and remediate vulnerabilities; coordinate penetration testing and vulnerability assessments.
• Review authentication, authorization, RBAC and multi-tenant security, and access controls, IAM, secrets management, encryption and backups.
• Implement and maintain security monitoring, logging and alerting, and secure development and deployment practices.
• Secure AWS, Cloudflare, databases and production infrastructure, and manage SAST, DAST, dependency and secret scanning tools.
• Assist with incident detection, investigation and response.
• Maintain security documentation, policies and technical evidence.
• Work with the Privacy/Compliance Specialist on ISO 27001/27701 requirements and audits, and train developers on secure coding.

Required profile

• Degree or diploma in Cybersecurity, Computer Science, IT or a related field.
• 2-5 years of practical cybersecurity experience.
• Experience securing web applications and APIs, and practical AWS/cloud security experience.
• Strong understanding of OWASP and application security, and experience with vulnerability assessment and security testing.
• Preferred: OSCP, OSWE, PNPT or equivalent; AWS Security Specialty; ISO 27001 experience or certification; SaaS and multi-tenant application experience; exposure to compliance/security audits.

Required skills

• OWASP Top 10 / ASVS, SQL injection, XSS, CSRF, IDOR/BOLA
• AWS security (IAM, VPC, RDS, S3, ALB, CloudTrail, CloudWatch), Linux, TLS/SSL, network security
• SAST/DAST, dependency and secret scanning, vulnerability management, incident response, penetration testing